Security update for cifs-utils

This update for cifs-utils fixes the following issue: CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you ca...

SUSE-SU-2026:4897-1 Security update for cifs-utils

This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932...

CVE-2025-30052

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

WordPress Depicter — Popup & Slider Builder plugin 4.0.5-4.8.1 - Editor+ Arbitrary File Upload vulnerability

Editor+ Arbitrary File Upload vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Depicter Slider versions 4.0.5-4.8.1...

Path Traversal

Vitest is vulnerable to Path Traversal. The vulnerability is due to inconsistent handling of backslashes between path validation and filesystem access on Windows, which allows an attacker who can access the Vite development server to craft a redirect mock that bypasses server.fs.allow restriction...

CVE-2026-98777

A flaw was found in the Linux kernel's Android Binder inter-process communication IPC driver. When an asynchronous transaction supersedes an earlier pending transaction in a frozen process, the kernel frees the outdated transaction without releasing associated file descriptor references. A local...

EUVD-2025-211182

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

CVE-2025-30051

The CGM CLININET application contains a vulnerability where the SysIO.pl configuration file is assigned insecure file permissions. This allows any local account to read the file, which stores sensitive production database login and password information along with RabbitMQ broker credentials . The...

CVE-2025-30051 Insecure File Permissions in CGM CLININET

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account. This issue was fixed in version 2026.MS3...

Security Bulletin: IBM SPSS Modeler is affected by a pip vulnerability that could allow arbitrary file writes through improperly handled package URLs from a malicious package index

Summary IBM SPSS Modeler is affected by a pip vulnerability that could allow arbitrary file writes through improperly handled package URLs from a malicious package index. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-13346 DESCRIPTION: pip would...

SUSE-SU-2026:24372-1 Security update for cifs-utils

This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS credentials-file parsing bsc1284932...

WordPress Music Store – WordPress eCommerce plugin <= 1.4.7 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Quentin VILLAIN in WordPress Plugin Music Store versions = 1.4.7...

CVE-2026-113472 Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

CVE-2026-113472

The Depicter — Popup & Slider Builder WordPress plugin (versions 4.0.5-4.8.1 ) contains an arbitrary file upload vulnerability in the editor media-upload endpoint. The root cause is insufficient validation, as the plugin only checks the client-supplied MIME type and a case-sensitive block of the ...

CVE-2026-113472 Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension, which allows users with the Editor role and above to...

Goploy: Arbitrary File Read Via Path Traversal In /deploy/fileDiff Allows Remote Server Compromise

Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Affected Product: Goploy - Known Affected Versions: =1.17.5 Vulnerability Description Goploy is an open-source automation deployment system. A severe...

CVE-2026-86019

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...

CVE-2026-86018

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment feature. When server-side attachment...

CVE-2026-59188

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with...

CVE-2026-115497

The Music Store WordPress eCommerce plugin is vulnerable to Directory Traversal in all versions up to and including 1.4.7 . The flaw exists in the 'f' parameter , allowing unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Successful explo...