CVE-2026-114462

The Velneo vServer HTTP Server is vulnerable to an arbitrary file read via symlink due to improper link resolution before file access (CWE-59). This vulnerability affects versions 32.3 to 36.6 and 37.1 to 37.2 . The impact allows for high confidentiality loss on the vulnerable system. No specific...

EUVD-2026-107307

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts...

CVE-2026-114253 oretnom23 file-management-system-php index.php include file inclusion

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely...

CVE-2026-114253 oretnom23 file-management-system-php index.php include file inclusion

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely...

EUVD-2026-107305

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely...

CVE-2026-114253

The oretnom23 file-management-system-php software (up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 ) is vulnerable to a file inclusion flaw. The issue resides in the include function within the index.php file, where manipulating the page argument allows for remote execution of the attack. W...

Security Bulletin: Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-81209)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed these security vulnerabilities Vulnerability Details CVEID:CVE-2026-81209 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to...

CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-60479

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

Vibe-Trading FastAPI Endpoints Permit Unauthenticated Access, File Upload, And An RCE Chain

Summary: 5 findings — unauthenticated full-API exposure F1, lead Critical, read-side authorization gap that persists even with "APIAUTHKEY" set F2, unauthenticated file write of ".py"/".sh"/".yaml" to a server-returned path F3, default-permissive CORS that combines with a loopback-only check to...

CVE-2026-111832 WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Server.This issue affects WP Mailster: from n/a through 1.9.1.0...

CVE-2026-111834

The Mang Board WP plugin for WordPress (versions

CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4...

CVE-2026-111832

The WP Mailster WordPress plugin (versions

CVE-2026-111834 WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Server.This issue affects Mang Board WP: from n/a through 2.4.4...

CVE-2026-111833 WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

CVE-2026-111833 WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28...

CVE-2026-111833

The Bold Grid weForms WordPress plugin (versions

pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and Pulp Container registry signing key theft

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...