491658 matches found
PT-2026-120714
A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save files of the file admin class.php. Executing a manipulation of the argument Upload can lead to unrestricted upload. It is possible to launch the attack...
PT-2026-120908
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...
CVE-2025-60487
A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted XML file...
PT-2026-134536
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220
This module enables you to use ffmpeg for image conversion The module doesn't sufficiently sanitize file names passed to the ffmpeg cli tool. This vulnerability is mitigated by the fact that an attacker must be able to upload images on the site...
PT-2026-134534
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit...
PT-2026-120799
A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...
Linux Distros Unpatched Vulnerability : CVE-2026-109744
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. CVE-2026-109744...
RockyLinux 8 : python3 (RLSA-2026:85239)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...
Linux Distros Unpatched Vulnerability : CVE-2026-92183
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on...
PT-2026-120715
A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This vulnerability affects the function delete folder of the file ajax.php of the component AJAX Handler. The manipulation of the argument ID leads to missing authentication. The...
Linux Distros Unpatched Vulnerability : CVE-2026-112935
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker...
Red Hat Enterprise Linux resource management error vulnerability
Red Hat Enterprise Linux contains a resource management error vulnerability. This vulnerability arises because, in builds where rpmio is enabled, the custom reader handler fails to limit the cumulative size after decompression prior to parsing. An attacker can supply a highly compressible YAML...
Linux Distros Unpatched Vulnerability : CVE-2026-114236
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can...
Linux Distros Unpatched Vulnerability : CVE-2026-112906
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker...
CVE-2025-60469
The GPAC Project/MP4Box software, in versions prior to 2.5 , contains a NULL pointer dereference vulnerability within the gf_ac4_presentation_ch_mode function located in /media_tools/av_parsers.c. This flaw allows an attacker to cause a Denial of Service (DoS) by providing a specially crafted AC4...
CVE-2025-60492
GPAC Project/MP4Box versions before 2.5 are vulnerable to a stack overflow within the gf_bifs_dec_node function located in /bifs/field_decode.c. This flaw allows an attacker to trigger a Denial of Service (DoS) by providing a specially crafted MP4 file . While the provided documents confirm the e...
CVE-2025-60476
The GPAC Project/MP4Box software (versions prior to 2.5 ) is vulnerable to a heap use-after-free condition within the gf_odf_ac4_cfg_clean_list function located in /odf/descriptors.c. This flaw can be triggered by an attacker providing a crafted AC4 file , potentially resulting in a Denial of Ser...
PT-2026-120605
A NULL pointer dereference in the StatSFVec2f function /scene manager/scene stats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...