Part-DB arbitrary file upload vulnerability

Versions prior to Part-DB 2.12.1 contain an arbitrary file upload vulnerability. This vulnerability arises because the attachment upload handler stores uploaded files using client-supplied file extensions; however, the extension blacklist does not include “phar”. As a result, uploaded .phar files...

PT-2026-121753

Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded file data. The application enforces...

PT-2026-121750

Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker can upload a malicious SVG with...

MiracleLinux 8 : python3-3.6.8-79.el8_10.ML.1 (AXSA:2026-2123:11)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2123:11 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verificatio...

RockyLinux 10 : buildah (RLSA-2026:88262)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:88262 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Apple container security vulnerability

Versions of the Apple container prior to 1.5.0 contain a security vulnerability. This vulnerability allows attackers to write to the container’s file system and insert an exec credential plugin into /etc/kubernetes/admin.conf. When kubectl runs on the host, it executes this plugin as a macOS user...

PT-2026-121833

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore and nextBackup functions in the backup controller accept a file GET parameter and concatenate it directly to DIR BACKUP without calling...

PT-2026-122443

Summary installBazaarPlugin and the equivalent endpoints for widgets/icons/templates/themes accept packageName, repoURL, and repoHash as independent request fields with no validation that they refer to the same package. packageName alone determines the install destination; repoURL/repoHash alone...

ROS-20261023-73-0123

The vulnerability of the HEIF and AVIF file encoding/decoding library lies in reading data from buffers beyond their acceptable limits. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Linux Distros Unpatched Vulnerability : CVE-2025-55667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV- rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2025-60490

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denia...

PT-2026-135180

Security vulnerability affects the glib package. file copy fallback in gio/gfile...

PT-2026-121836

VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

PT-2026-121888

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage such as S3, GCS, or Azure to execute arbitrary file write...

Mervin Praison PraisonAI permission and access control issue vulnerability

Versions 4.5.110 through 4.6.61 of Mervin Praison PraisonAI contain a security vulnerability. This vulnerability arises because SandlockSandbox fails to shut down upon encountering Landlock; instead, it reverts to SubprocessSandbox. As a result, file systems and network boundaries are not enforce...

Mervin Praison PraisonAI information disclosure vulnerability

Versions Mervin Praison PraisonAI from 3.8.1 up to 4.6.59 contain a security vulnerability. This vulnerability arises because the Dynamic Context Discovery feature exposes the artifact helper via ctx.gettools, without verifying whether artifactpath points to an artifact created within the...

Ancorathemes Your Dress code injection vulnerability

Ancorathemes: Versions 1.4.1 and earlier of Your Dress contain a code injection vulnerability. This vulnerability stems from improper control over filenames in Include/Require statements within PHP, potentially leading to local file inclusion...

Linux Distros Unpatched Vulnerability : CVE-2025-55640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a...

Linux Distros Unpatched Vulnerability : CVE-2026-114094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a...