CVE-2026-81651

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authenticated cross-gallery settings modification due to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify gallery ownership when a user saves settings, allowing any user with gallery-manag...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

Updated ntfs-3g packages fix security vulnerabilities

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. CVE-2026-42616 Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. CVE-2026-42617 Single-byte heap buffer overflow when decompressing...

MGASA-2026-0424 Updated ntfs-3g packages fix security vulnerabilities

Heap memory corruption when processing a corrupt or maliciously crafted filesystem. CVE-2026-42616 Heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. CVE-2026-42617 Single-byte heap buffer overflow when decompressing...

PT-2026-95916

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

EUVD-2026-83268

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-81321

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

CVE-2026-81321 CareCam CM2507 Cleartext Storage of Sensitive Information

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

EUVD-2026-83053

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

CVE-2026-81321

CareCam CM2507 IP cameras store configured wireless network credentials (network identifier and pre-shared key) in cleartext within the device filesystem. An attacker who obtains filesystem access—through physical access, a debugging interface, or another vulnerability—can recover these credentia...

CVE-2026-81321 CareCam CM2507 Cleartext Storage of Sensitive Information

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

CVE-2026-90982

A flaw was found in @fastify/static, a Fastify plugin for serving static files. On case-insensitive filesystems, such as Windows or default macOS volumes, a route guard or allowedPath restriction can be bypassed. This occurs because the route matcher is case-sensitive while the filesystem is not,...

SUSE CVE-2026-90419

In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-root inode metadata size is trusted before nilfsreadinodecommon. Reject super-root inode sizes whose computed on-disk footprint exceeds the filesystem block siz...

CVE-2026-77385: Authorization Bypass Through User-Controlled Key

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

Linux Distros Unpatched Vulnerability : CVE-2026-93380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social...

Linux Distros Unpatched Vulnerability : CVE-2026-90203

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause...

CVE-2026-81321: Cleartext Storage of Sensitive Information

CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key...

Linux Distros Unpatched Vulnerability : CVE-2026-90260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - btrfs: zoned: don't clobber the extent buffer when zeroing it out On a zoned filesystem a freed-but-still- dirty tree block is written out as zeros...