CVE-2026-89242

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

[SECURITY] Fedora 44 Update: dokuwiki-20250514b-8.fc44

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creati ng documentation of any kind. It has a simple but powerful syntax which makes su re the data-files remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...

EUVD-2026-75775

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

ImageMagick < 6.9.13-55 / 7.x < 7.1.2-26 Memory Leak

The remote host has a version of ImageMagick installed that is prior to 6.9.13-55, or 7.x prior to 7.1.2-26. It is, therefore, affected by a vulnerability. - ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the JNG encoder when a blob cannot be opened. Attackers can trigger the...

Fedora 45 : gegl04 (2026-03ea7c5707)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-03ea7c5707 advisory. This update fixes an overflow in parsing RGBE/HDR image files. Tenable has extracted the preceding description block directly from the Fedora security...

CVE-2026-77807: Improper Limitation of a Pathname to a Restricted Directory

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

CVE-2026-89250: Missing Authentication for Critical Function

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-87727: Improper Limitation of a Pathname to a Restricted Directory

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-89013: Incorrect Authorization

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89668: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: move nfsddebugfsinit after nfsd4initslabs in initnfsd nfsddebugfsinit runs before nfsd4initslabs in initnfsd. If the slab allocation fails, the bare "return retval" bypasses nfsddebugfsexit, leaving orphan debugfs files wit...

PT-2026-96455

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing file open derives the path to be stored in the new backing file from user file-f path. This is incorrect when user file itself is a backing file, which is the case for nested...

CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2026-18994

CVE-2026-18994 is a potential improper authorization vulnerability in the Lenovo File Manager Android Application , which is distributed exclusively in the Chinese market. A local authenticated user could read or modify protected files within the application. Lenovo rates this HIGH severity with ...

EUVD-2026-75752

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

Directory Traversal

Overview icecoder/icecoder is a Browser based code editor allowing you to code from anywhere. Affected versions of this package are vulnerable to Directory Traversal via the oldFileName parameter in file move and rename operations. An attacker can access or relocate files outside the intended...

CVE-2026-4129 Improper Access Controls in NI SystemLink

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

CVE-2026-84828

A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-84311 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-84311 Source advisory: OSV:PYSEC-2026-3911...

assert-files (>=0.1.0, <=0.1.3), vpplib (0.0.4) +1 more potentially affected by CVE-2026-84310 via pypdf (3.16.4)

pypdf PYPI version 3.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - assert-files =0.1.0, =0.61.0, =0.65.0 Source cves: CVE-2026-84310 Source advisory: OSV:PYSEC-2026-3910...