CVE-2026-76550

The WP Import Export Lite WordPress plugin versions before 3.9.34 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to validate a user-supplied output path when writing export files, which allows authenticated users with export permissions to write files with arbitrary na...

EUVD-2026-80175

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

SUSE CVE-2026-82035

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

SUSE CVE-2026-87984

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

PT-2026-93780

Name of the Vulnerable Software and Affected Versions Jenkins Robot Framework Plugin versions prior to 6.2.3 Description The plugin fails to verify if the archive directory configured for Robot Framework report files is located within the build directory on the Jenkins controller. This allows use...

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software. Update your software...

PT-2026-94034

Name of the Vulnerable Software and Affected Versions BC Security Empire versions prior to 6.7.1 Description Authenticated operators can write files to arbitrary paths on the C2 server because the software fails to validate the multipart filename parameter in upload endpoints. By using path...

CVE-2026-92604: Improper Limitation of a Pathname to a Restricted Directory

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...

CVE-2026-92748: Improper Limitation of a Pathname to a Restricted Directory

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-92816: Improper Limitation of a Pathname to a Restricted Directory

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-89084: Improper Limitation of a Pathname to a Restricted Directory

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...

CVE-2026-89082: Improper Control of Generation of Code

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...

CVE-2026-89083: Improper Control of Generation of Code

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...

PT-2026-93276

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

PT-2026-93943

Name of the Vulnerable Software and Affected Versions HP Advance affected versions not specified Description Security issues in the HP Advance server may allow an attacker to achieve elevation of privilege, remote code execution, or arbitrary file write under specific conditions. Recommendations...

PT-2026-94088

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.30.0 Description Insufficient sanitization of the folder name input in dataset save nodes allows attackers to write files to arbitrary paths outside the designated output directory. By loading a crafted workflow, an...

PT-2026-93877

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...

PT-2026-94020

Name of the Vulnerable Software and Affected Versions HP Advance affected versions not specified Description Security flaws in the HP Advance software may allow an attacker to perform elevation of privilege, remote code execution, or arbitrary file write on the server hosting the software...

PT-2026-94006

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker with administrative privileges to write arbitrary files ...

PT-2026-94019

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...