EUVD-2026-68117

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

CVE-2026-82460 Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

CVE-2026-82460 Cloud Commander before 19.20.2 Directory Traversal via REST and Markdown

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

CVE-2026-82460

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in its REST file-operation and markdown endpoints, caused by improper path normalization validation. An unauthenticated, remote attacker can use path traversal sequences to read, write, move, or copy files outside the con...

CVE-2026-14494

CVE-2026-14494 is a critical (CVSS 9.8) unauthenticated Remote Code Execution vulnerability in the Sigma Forms Pro plugin for WordPress, affecting all versions up to and including 1.4.5 . The flaw resides in the handle_form_submission function, which dynamically grants the unfiltered_upload capab...

CVE-2026-14494 Sigma Forms Pro <= 1.4.5 - Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field

The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handleformsubmission function. This is due to the plugin dynamically granting the unfilteredupload capability to all users during form submissions and bypassing MIME...

XML External Entity (XXE) Injection

mapfish-print is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper parsing of attacker-controlled XML with external entities and DTDs enabled, which allows an unauthenticated attacker to read local files and perform server-side request forgery SSRF by accessing...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

Laravel with Ignition <= v8.4.2 Debug Mode - Remote Code Execution

Laravel version 8.4.2 and before with Ignition before 2.5.2 allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2. id: CVE-2021-3129 info: name:...

CVE-2026-77012

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-76548

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

CVE-2026-77012 Icollect <= 1.0.0 - Unauthenticated Arbitrary File Read, SSRF and Path Traversal File Write via Default Publishing Password

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

CVE-2026-77012

CVE-2026-77012 affects the 爱采集数据采集和发布插件 (Icollect) WordPress plugin, versions through 1.0.0 . The root cause is a hardcoded default publishing password on an unauthenticated endpoint combined with missing validation of URLs and destination paths. This allows unauthenticated attackers to perform a...

EUVD-2026-68057

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not require a per-install secret for one of its unauthenticated endpoints, relying on a hardcoded default, and does not validate the URLs or destination paths it is given, allowing unauthenticated attackers to read arbitrary files from the...

EUVD-2026-68052

The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media item...

SUSE CVE-2026-33263

When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running in high-security mode default for community releases, only the new submission connection gets terminated. If running in high-performance...

EUVD-2026-67954

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal...

PT-2026-83409

Name of the Vulnerable Software and Affected Versions 爱采集数据采集和发布插件 WordPress plugin versions prior to 1.0.1 Description An unauthenticated endpoint relies on a hardcoded default secret instead of a per-install secret and fails to validate URLs or destination paths. This allows unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-33263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When mailmaxuseripconnections is set default 10 and reached, submission-login can crash with epoll panic caused by file descriptor handling issues. If running i...

Unity Linux 20.1070e Security Update: spice-vdagent (UTSA-2026-104950)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104950 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files to any location on the gue...