EUVD-2026-94833

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-104660 Missing Authorization in hMailServer

Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

EUVD-2026-94790

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85487

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0 . An unauthenticated attacker located on the local network can send manipulated API requests to the service endpoint to bypass path restrictions. This flaw could lead to arbitrary file read, ...

EUVD-2026-94749

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

CVE-2026-5049

A path traversal vulnerability exists in the Zone Alias Import flow feature of the HPE B-Series SANnav Management Portal (prior to versions 3.0.0a and 3.0.1 ) and Brocade SANnav (before 3.0.0a ). A local authenticated attacker can exploit this flaw to write uploaded content outside the intended d...

Exploit for Improper Access Control in Ollyo Helix3

CVE-2026-49049 — Helix3 Joomla Unauthenticated Arbitrary JSO...

CVE-2026-85487: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

PT-2026-107845

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

PT-2026-108231

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description A path traversal issue allows a remote attacker to perform an arbitrary file write. Path traversal is a technique use...

CVE-2026-19493: Improper Limitation of a Pathname to a Restricted Directory

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal...

PT-2026-107856

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-19585: Improper Limitation of a Pathname to a Restricted Directory

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-107639: Improper Neutralization of Argument Delimiters in a Command

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd does no...

CVE-2026-84275: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

CVE-2026-85490: Improper Limitation of a Pathname to a Restricted Directory

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-3944)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...