PT-2026-91596

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 visionOS versions prio...

CVE-2026-82035: Improper Limitation of a Pathname to a Restricted Directory

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

PT-2026-91036

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2023-22632

PRTG Network Monitor (Paessler) before version 23.1.82 is affected by a vulnerability that allows remote attackers to write to files via the FTP Server Count Sensor . The attack requires high privileges (authenticated access) over the network, resulting in a low integrity impact (CVSS 3.1 score 2...

Linux Distros Unpatched Vulnerability : CVE-2026-82035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output...

CVE-2023-22631

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2026-90774

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774

rustypaste before 0.18.1 is vulnerable to a path traversal via the optional custom filename HTTP header. The root cause is that the destination path is validated before the filename header is applied, so an attacker can supply traversal sequences (e.g., ../) in the header to write files outside t...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

EUVD-2026-76995

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

PT-2026-90841

Name of the Vulnerable Software and Affected Versions rustypaste versions prior to 0.18.1 Description An issue exists where the destination path is validated before the optional custom filename HTTP header is applied, which allows the bypass of directory-escape checks. Attackers can use path...

CVE-2026-90774: Improper Limitation of a Pathname to a Restricted Directory

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-82845

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

CVE-2026-82845

The Masteriyo LMS WordPress plugin (versions before 3.4.1 ) is vulnerable to PHP Object Injection due to the failure to prevent deserialization of user-supplied values held as metadata. An attacker with a minimal account can inject arbitrary PHP objects, leveraging a class in a bundled library to...

EUVD-2026-76787

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 This repository contains a Python-based scanne...

EUVD-2026-76748

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...