WG-CVE-2026-1555-Linux

██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ╚════██╗██╔═████╗╚════██╗██╔════╝ ██║ ██║ ██║█████╗ █████╔╝██║██╔██║ █████╔╝███████╗ ██║ ╚██╗ ██╔╝██╔══╝ ██╔═══╝ ████╔╝██║██╔═══╝ ██╔═══██╗ ╚██████╗ ╚████╔╝ ███████╗ ███████╗╚██████╔╝███████╗╚██████╔╝ ╚═════╝ ╚═══╝...

Coraza: Multipart Filename* (RFC 5987) Charset Restriction Lets A Decoy Filename Bypass FILES-based Rules

Summary Coraza extracts a multipart file upload's filename using Go's standard-library "mime.ParseMediaType", which only decodes the RFC 5987/6266 extended "filename" "Content-Disposition" parameter when its declared charset is exactly "us-ascii" or "utf-8". Any other charset — including...

DRUPAL-CONTRIB-2026-220

This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...

Vibe-Trading FastAPI Endpoints Permit Unauthenticated Access, File Upload, And An RCE Chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with "APIAUTHKEY" set F2, unauthenticated file write of ".py"/".sh"/".yaml" to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to...

CVE-2026-111834

The Mang Board WP plugin for WordPress (versions

CVE-2026-111832 WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0...

CVE-2026-111832

The WP Mailster WordPress plugin (versions

CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4...

CVE-2026-114398

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

CVE-2026-114398 Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

EUVD-2026-107245

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

CVE-2026-114398 Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

CVE-2026-114398

The Trudesk application, through version 1.2.11 , is vulnerable to an unrestricted file upload (CWE-434) via the /settings/general/uploadlogo, uploadpagelogo, and uploadfavicon endpoints. This flaw allows any authenticated user to upload HTML or SVG files into the public webroot. By spoofing an i...

EUVD-2026-106862

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

SMG Software Information Portal Shell Upload / Command Injection

SMG Software Information Portal versions prior to 13.06.2025 contain an unrestricted dangerous-file upload and OS command injection vulnerability...

PT-2026-120585

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

CVE-2026-87800

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

CVE-2026-87800

The IBM Cyber Fraud software (versions 1.0.0 through 1.0.2 ) is vulnerable to arbitrary code execution. The root cause is the unrestricted upload of a file with a dangerous type (CWE-434), which could be exploited by a remote authenticated attacker requiring user interaction. To remediate this vu...

CVE-2026-87800 IBM Cyber Fraud includes components with multiple known vulnerabilities

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

CVE-2026-3891-Linux

███████╗██████╗ ██╗███████╗███╗ ██╗██████╗ ███████╗ ██╔════╝██╔══██╗██║██╔════╝████╗ ██║██╔══██╗██╔════╝ █████╗ ██████╔╝██║█████╗ ██╔██╗ ██║██║ ██║███████╗ ██╔══╝ ██╔══██╗██║██╔══╝ ██║╚██╗██║██║ ██║╚════██║ ██║ ██║ ██║██║███████╗██║ ╚████║██████╔╝███████║ ╚═╝ ╚═╝ ╚═╝╚═╝╚══════╝╚═╝ ╚═══╝╚═════╝...