CVE-2026-115451

The Advanced Custom Fields (versions 2.8.13-2.8.15, 3.1.4-3.1.8) and Smile Pack (versions 1.2.7-1.2.9, 2.1.2-2.1.6) Joomla extensions are vulnerable to improper access control . This flaw allows unauthenticated users to delete images within Gallery folders , including those on published articles ...

CVE-2026-115451 Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6

Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without...

nccfsas

Introduction This repository holds information released publicly by NCC Group's Full Spectrum Attack Simulation FSAS team...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

CVE-2026-21986-VirtualBox-DoS

CVE-2026-21986 - VirtualBox Shared Folders Kernel Memory Exhaustion DoS Overview This repository contains a proof of concept and technical write-up for CVE-2026-21986, a denial-of-service vulnerability in Oracle VM VirtualBox. The issue exists in the Shared Folders driver interface and allows...

stirling-storage-folder-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · stirling-storage-folder-idor stirling-storage-folder-idor Stirling-PDF 3.2.0 - Stirling Tools Class: IDOR. Reach: Remote ROLEUSER. POST /api/v1/processing-folders has no @PreAuthorize beyond a logged-in user...

CVE-2026-119659

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

EUVD-2026-114075

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

CVE-2026-119659 Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

CVE-2026-119659

The software Blossom (versions through 1.17.1 ) is vulnerable to an authorization bypass in its folder endpoints. The root cause is that the FolderService queries filter exclusively on the folder id , failing to verify ownership. This allows authenticated users to access other users' folders by p...

CVE-2026-119659: blossom-editor Blossom: Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other…

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

PT-2026-133589

Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/upd, /folder/open or /folder/del to...

CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

CVE-2026-118075

The WP Media folders plugin for WordPress, affecting versions

PT-2026-132249

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

CVE-2026-118075: dbarrere WP Media folders: Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Media folders versions = 1.1.10...

EUVD-2026-106403

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87362

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...