CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ Arbitrary File Write vulnerability

Admin+ Arbitrary File Write vulnerability discovered by Nir Yehoshua in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

OESA-2026-3538 rubygem-fluentd security update

Fluentd is an open source data collector designed to scale and simplify log management. It can collect, process and ship many kinds of data in near real-time. Security Fixes: Fluentd allows dynamically constructing file paths using the $tag placeholder. It was discovered that validation for this...

OESA-2026-3526 docker security update

Docker is a product for you to build, ship and run any application as a lightweight container. Security Fixes: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...

OESA-2026-3499 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the...

OESA-2026-3498 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the...

OESA-2026-3497 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the...

OESA-2026-3496 python-django security update

A high-level Python Web framework that encourages rapid development and clean, pragmatic design. Security Fixes: An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the...

PT-2026-83524

Name of the Vulnerable Software and Affected Versions WPvivid — Backup, Migration & Staging versions prior to 0.9.133 Description The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a...

Security update for git-lfs (important)

openSUSE Security Update: Security update for git-lfs Announcement ID: openSUSE-SU-2026:0305-1 Rating: important References: 1239322 1252259 Cross-References: CVE-2025-22869 CVE-2025-26625 CVSS scores: CVE-2025-22869 SUSE: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

CVE-2026-19722: Improper Limitation of a Pathname to a Restricted Directory

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

CVE-2026-82656: Improper Limitation of a Pathname to a Restricted Directory

Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated users with album-creation rights to include path traversal segments in archive entry names. Attackers can craft malicious album names containing directory traversal sequences that...

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and...

CVE-2026-77012

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

EUVD-2026-68057

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

Exploit for CVE-2026-82286

CVE-2026-82286 — gpt-crawler Unauthenticated Arbitrary File Wr...

PT-2026-83409

Name of the Vulnerable Software and Affected Versions 爱采集数据采集和发布插件 WordPress plugin versions prior to 1.0.1 Description An unauthenticated endpoint relies on a hardcoded default secret instead of a per-install secret and fails to validate URLs or destination paths. This allows unauthenticated...

Unity Linux 20.1070e Security Update: spice-vdagent (UTSA-2026-104950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104950 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the gue...