27318 matches found
CVE-2025-69110
The CVE-2025-69110 entry documents an Unauthenticated Local File Inclusion in AirSupply WordPress Theme ≤ 2.0.0. The vulnerability affects the AirSupply theme’s handling of local files (LFI) and is described with CVSS 3.1/HIGH (8.1) metrics, indicating high impact on confidentiality, integrity, a...
CVE-2025-58954
CVE-2025-58954 affects the WordPress Theme HomeRoofer (
CVE-2025-58954 WordPress HomeRoofer theme <= 2.11.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in HomeRoofer = 2.11.0 versions...
CVE-2025-58953 WordPress Joly theme <= 1.22.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Joly = 1.22.0 versions...
CVE-2025-58953
CVE-2025-58953 affects WordPress Joly theme versions
CVE-2025-58952
CVE-2025-58952 : Unauthenticated Local File Inclusion in WordPress Neuronet theme prior to 1.14.0. Affected: Neuronet
CVE-2025-58952 WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Neuronet 1.14.0 versions...
postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind
A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pgbasebackup plain format and pgrewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical...
CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...
CVE-2026-50203 Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside the destination directory via malicious server-supplied directory-entry names
A path traversal in the SFTP provider SFTPHook.retrievedirectory / SFTPOperatoroperation=get let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is a...
CVE-2025-26240
The CVE-2025-26240 entry affects JazzCore’s python-pdfkit 1.0.0, where the from_string method allows JavaScript to execute within the server context and enables exfiltration of local files. This indicates a server-side execution vector with high impact on confidentiality, integrity, and availabil...
CVE-2025-26240
In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...
MiracleLinux 8 : dotnet9.0-9.0.118-1.el8_10 (AXSA:2026-790:10)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-790:10 advisory. dotnet: .NET: Local file tampering via link following vulnerability CVE-2026-45491 dotnet: ASP.NET Core: Denial of Service via uncontrolled resource...
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
GHSA-QW24-GH76-8RVV Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix
Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...
CVE-2026-39568
CVE-2026-39568 affects the WordPress Mr. SEO theme (versions
CVE-2026-39568 WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Mr. SEO = 2.0 versions...
CVE-2026-39549
The CVE-2026-39549 entry describes an Unauthenticated Local File Inclusion in the WordPress Aperitif theme (versions