CVE-2026-53453

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-68924

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:08+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9...

WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability

Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...

CVE-2026-73373

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

EUVD-2026-61026

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-28192

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

EUVD-2026-60810

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73996

The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.

EUVD-2026-60916

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-66627

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-66627 WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-66627

The WordPress GP Premium plugin (versions ≤ 2.5.5) allows contributors to upload arbitrary files, enabling potential remote code execution, data theft, or site defacement. CVSS 9.9 (Critical) reflects network-accessible, low-complexity exploitation with low privileges required. Update to the late...