PT-2026-73434

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

PT-2026-76894

Name of the Vulnerable Software and Affected Versions uniget CLI affected versions not specified Description A path traversal issue exists in the handling of hook filenames. The application fails to sanitize user input, allowing the direct concatenation of filenames with the hooks directory path...

Unity Linux 20.1070e Security Update: expat (UTSA-2026-099515)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099515 advisory. xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Tenable has extracted the preceding description block...

CVE-2026-18438

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

CVE-2026-15965

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

CVE-2026-15965

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

CVE-2026-15965

The CVE-2026-15965 entry concerns the WordPress plugin “MaxUpload – Big File Uploads – Increase Maximum File Upload Size”. A root cause is a filename-validation mismatch in handle_upload: extension and MIME checks are applied to the uploaded chunk’s filename but not to the final assembled filenam...

CVE-2026-15965 MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter

The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handleupload function. This is due to a filename-validation mismatch in the handleupload function where extension an...

PT-2026-72147

Name of the Vulnerable Software and Affected Versions MaxUpload – Big File Uploads – Increase Maximum File Upload Size versions prior to 1.4.1 Description An arbitrary file upload issue exists in the handle upload function. A filename-validation mismatch occurs because extension and MIME checks a...

PT-2026-72881

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2 Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetc...

CVE-2026-73680

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-73680 Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is...

CVE-2026-19679

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue...

CVE-2026-19679

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue...

CVE-2026-19679 Improper Input Validation

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue...

EUVD-2026-58741

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue...

CVE-2026-19679

Affects Security Center; CVE-2026-19679 is described as an input validation issue in the file-upload handling where insufficient sanitization of filenames could contribute to a downstream command injection. Tenable’s advisory for Security Center version 6.9.0 notes fixes that upgrade core compone...

CVE-2026-19829

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19829

Affected product: 648540858 wvp-GB28181-pro 2.7.4-20260107. The vulnerability resides in the Log File Download Endpoint, specifically LogController.java, where manipulation of the fileName argument enables path traversal. Remote exploitation is possible, and public exploits have been released. CV...

CVE-2026-19829 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...