491626 matches found
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
CVE-2026-114236
The Podman container engine contains a resource leak in the storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer functions. When processing corrupt or malicious inputs, these functions may leak a file descriptor due to a goroutine-related issue. Unbounded repeated calls can lead to the exhau...
EUVD-2026-107140
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
CVE-2026-114236 Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
Exploit for CVE-2026-109618
php2shell — CVE-2026-109618 / CVE-2026-109619 Research Indepe...
RLSA-2026:85239 Important: python3 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
CVE-2026-79627
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
CVE-2026-111956
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...
CVE-2026-79627
The Advanced File Manager WordPress plugin (versions before 6.0.0 ) is vulnerable to Authenticated Stored XSS due to a failure in correctly identifying SVG files before sanitization. An attacker with file-manager permissions can upload a file containing a script that bypasses stripping and execut...
CVE-2026-79627 Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
WordPress Advanced File Manager plugin < 6.0.0 - Authenticated Stored XSS vulnerability
Authenticated Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced File Manager versions 6.0.0...
CVE-2026-79627 Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
EUVD-2026-107081
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone w...
EUVD-2026-107078
The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...
GHSA-M3WX-QQMX-QXVF Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references. Original Description Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by...
Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pjjw-68hj-v9mw. This link is maintained to preserve external references. Original Description Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by...
Directory Traversal
Overview uv is an An extremely fast Python package and project manager, written in Rust. Affected versions of this package are vulnerable to Directory Traversal via a symlink sequence during source distribution sdist tar extraction. When a victim installs a malicious sdist, a crafted sequence of...
CVE-2026-82814 Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection
The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and 4.6.10, respectively, via deserialization of untrusted database content in DUPXUpdateEngine::unserializeTest during migration. This allows unauthenticate...