GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

CVE-2026-108902

The pH7Builder (pH7 Social Dating CMS) software before version 18.5.0 is vulnerable to a path traversal vulnerability within the picture module 's deletePhoto() action. An authenticated member can exploit this by supplying ../ sequences in the POST picture_link parameter to delete arbitrary files...

The vulnerability of the ReadyScript e-commerce management system, related to the unlimited loading of dangerous type files, allows a hacker to upload any type of files.

The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...

The vulnerability of the ReadyScript e-commerce management system, related to the unlimited loading of dangerous type files, allows a hacker to upload any type of files.

The vulnerability of the ReadyScript e-commerce management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to load any desired files...

The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system (CMS) like 1C-Bitrix. This feature allows unauthorized users to execute arbitrary code by enabling unlimited uploading of dangerous types of files.

Vulnerability of “Before and After Photos”: Comparison of images before/after by a content management system CMS like 1C-Bitrix. Website management involves unlimited uploading of dangerous files. Exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely...

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in improper restrictions on path names to the catalog. This allows attackers to gain unauthorized access to local files and directories.

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files and directories on the server...

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the OpenSky flight planning and operational management system, related to unlimited loading of dangerous file types, allows a perpetrator to execute arbitrary commands.

The vulnerability of the OpenSky flight planning and operational management system lies in its ability to load files of a dangerous type without limitation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from improper external control of file names or paths, allowing attackers to delete arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to incorrect external control using filenames or paths. Exploiting this vulnerability could allow a malicious actor to delete any files at will...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from incorrect restrictions on the path name to the catalog, allowing a intruder to write arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from incorrect restrictions on the path name to the catalog, allowing attackers to read and write arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

CVE-2026-108839

The software thClaws (versions through 0.141.0 ) is vulnerable to a link-following vulnerability (CWE-59) within the post_inputs handler of the v1 API POST /v1/inputs endpoint. An attacker can plant a symlink under the permitted inputs/ prefix, which allows subsequent authenticated uploads to wri...

CVE-2026-108730

A flaw was found in Raven. Legacy application programming interface API endpoints fail to verify workspace membership when retrieving messages and shared files. An authenticated remote attacker who is not a member of a workspace can exploit this flaw using predictable channel identifiers, resulti...

CVE-2026-108759

Versions 0.9.0 through 0.9.4 of mistral.rs are vulnerable to a sandbox escape via a link following vulnerability in the mistralrs-code-exec component. The root cause is improper link resolution (CWE-59), which allows sandboxed shell code to read and overwrite files outside the designated sandbox ...

EUVD-2026-96924

mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the sandbox via symlinks. Attackers or prompt-injected agents can name symlinks as outputs or reuse sessions with symlinked input path...

CVE-2026-108751

The MoAI-ADK software, versions through 3.1.2 , is susceptible to an improper link resolution (CWE-59) vulnerability within the moai init template deployer . The root cause is the application's failure to properly resolve links during the staging process, allowing malicious repositories to utiliz...

EUVD-2026-96916

MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so...

EUVD-2026-96895

Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private attachments by setting the URL kind segment to page, icon, or namespace. Attackers who know a private record or module attachment i...