CVE-2026-37070: Improper Access Control

Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint...

CVE-2026-77017: Exposure of Sensitive Information to an Unauthorized Actor

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its...

CVE-2026-47894: Undefined Security Weakness

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

PT-2026-82581

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Failure to authenticate the presence of recovery slots in envelope-format encrypted files allows attackers to remove these slots without re-encrypting the payload. By modifying the file heade...

PT-2026-82583

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The desktop GUI writes decrypted plaintext using world-readable default permissions. This allows unprivileged local users on multi-user systems to read the decrypted output files...

CVE-2026-81727: Improper Link Resolution Before File Access

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

Debian dsa-6470 : gimp - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6470 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6470-1 [email protected] https://www.debian.org/securit...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the getminbuffersize function when processing specially crafted video files. An attacker can cause the application to crash by supplying a maliciously crafted video file. Remediation Upgrade ffmpeg to version...

Malcolm v26.08.0

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

CVE-2026-80426

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the...

GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Encoded slash %2F bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5...

Security update for go1.27

This update for go1.27 fixes the following issues: go1.27.0 released 2026-08-19 is a major release of Go. go1.27.x minor releases will be provided through August 2027. https://github.com/golang/go/wiki/Go-Release-Cycle go1.27 arrives six months after Go 1.26. Most of its changes are in the...

CVE-2026-77658

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, busload reads the number of bus handles from the file attribute "bushandles" using attributenumdata without validating an upper...

CVE-2026-77658

A stack-based buffer overflow in the Dia diagram editor (0.98.0 and earlier) occurs when processing Network Bus objects from XML project files. In bus_load(), the bus_handles count is read without an upper bound and later passed to g_alloca() in bus_handle_moved(), allocating two stack arrays pro...

CVE-2026-80234

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

Path Traversal

Whistle is vulnerable to Path Traversal. The vulnerability is due to improper validation of the user-supplied filename parameter, which allows a remote attacker to access and read arbitrary files from the server, such as /etc/passwd...

Malcolm v26.08.0

Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...

PT-2026-88955

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.60 Description GitPython fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files such as gitdir, commondir, and HEAD. An attacker can execut...

CVE-2026-75331: Unrestricted Upload of File with Dangerous Type

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

Oracle Linux 9 : nginx:1.26 (ELSA-2026-59496)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-59496 advisory. - Fixes CVE-2026-56434 and CVE-2026-60005 - nginx: code execution and denial of service CVE-2026-9256 - Resolves: RHEL-176218 - nginx:1.26/nginx: NGIN...