27294 matches found
CVE-2025-58953
CVE-2025-58953 affects WordPress Joly theme versions
CVE-2025-58952
CVE-2025-58952 : Unauthenticated Local File Inclusion in WordPress Neuronet theme prior to 1.14.0. Affected: Neuronet
CVE-2025-58952 WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...
postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind
A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...
CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...
CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...
CVE-2025-26240
In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...
CVE-2025-26240
The CVE-2025-26240 entry affects JazzCore’s python-pdfkit 1.0.0, where the from_string method allows JavaScript to execute within the server context and enables exfiltration of local files. This indicates a server-side execution vector with high impact on confidentiality, integrity, and availabil...
MiracleLinux 8 : dotnet9.0-9.0.118-1.el8_10 (AXSA:2026-790:10)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-790:10 advisory. dotnet: .NET: Local file tampering via link following vulnerability CVE-2026-45491 dotnet: ASP.NET Core: Denial of Service via uncontrolled resource...
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
GHSA-QW24-GH76-8RVV Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
CVE-2026-39568
CVE-2026-39568 affects the WordPress Mr. SEO theme (versions
CVE-2026-39568 WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
CVE-2026-39549
The CVE-2026-39549 entry describes an Unauthenticated Local File Inclusion in the WordPress Aperitif theme (versions
CVE-2026-39549 WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Aperitif = 1.5 versions...
CVE-2026-39547
CVE-2026-39547 : Unauthenticated Local File Inclusion in WordPress Theme Getaway versions before 1.8. The connected records confirm, for Getaway
CVE-2026-39547 WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Getaway 1.8 versions...
CVE-2026-39522 WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Solene = 3.4 versions...