GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-60026

creationtimestamp| type| source ---|---|--- 2026-07-20 21:09:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr47dtknsf2o...

CVE-2026-8169

creationtimestamp| type| source ---|---|--- 2026-07-20 21:07:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr476wzvgh2i...

CVE-2026-56452

creationtimestamp| type| source ---|---|--- 2026-07-20 21:05:08+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr473himo32d 2026-07-20 22:00:50+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr4c723ilb2q 2026-07-20 22:45:47+00:00| seen|...

CVE-2026-44178

creationtimestamp| type| source ---|---|--- 2026-07-20 21:04:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr472hiqxd2i 2026-07-23 06:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrc6cgkyoy23...

CVE-2026-44231

creationtimestamp| type| source ---|---|--- 2026-07-20 20:48:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr464wrabs2v 2026-07-21 09:38:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr5j5tfdjz2u...

CVE-2026-63108

creationtimestamp| type| source ---|---|--- 2026-07-20 20:00:40+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mr43i5ubog2q 2026-07-20 21:44:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr4bbgq76c2i...

CVE-2026-32806

creationtimestamp| type| source ---|---|--- 2026-07-20 19:57:31+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr43ck2wnm2j...

CVE-2026-53593

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylist that neutralizes dangerous file uploads "Helper::$restrictedextensions" is incomplete: it does not cover the ".pht" extension. The authenticated upload endpoint "POST...

CVE-2026-50743

creationtimestamp| type| source ---|---|--- 2026-07-20 19:20:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3zaum4cl2q...

CVE-2026-47276

creationtimestamp| type| source ---|---|--- 2026-07-20 18:55:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3xu3qyb32b...

CVE-2026-64187

creationtimestamp| type| source ---|---|--- 2026-07-20 18:33:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wmsx27o23 2026-07-22 09:05:35+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr7xsn3gbl25 2026-07-22 09:05:37+00:00| seen|...

CVE-2026-55238

creationtimestamp| type| source ---|---|--- 2026-07-20 18:27:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3wbzcini24...

CVE-2026-64190

creationtimestamp| type| source ---|---|--- 2026-07-20 18:24:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3w3ubzed22...

CVE-2026-64192

creationtimestamp| type| source ---|---|--- 2026-07-20 18:22:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vyzkyyq2i 2026-09-15 12:46:43+00:00| seen| https://vulnerability.circl.lu/bundle/0993320a-8372-47e9-a37e-158a64a4e0dc 2026-10-01 18:00:00+00:00| seen|...

CVE-2026-64205

creationtimestamp| type| source ---|---|--- 2026-07-20 18:21:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vwdc7b22j 2026-07-22 09:05:28+00:00| seen| https://bsky.app/profile/cybernewsroom.bsky.social/post/3mr7xsftuey2g 2026-07-22 09:05:30+00:00| seen|...

CVE-2026-28220

creationtimestamp| type| source ---|---|--- 2026-07-20 18:15:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vllatfw2g...

CVE-2026-61548

creationtimestamp| type| source ---|---|--- 2026-07-20 17:42:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mr3trxldl322 2026-09-21 12:15:04+00:00| seen| https://www.acn.gov.it/portale/w/rsyslog-poc-pubbliche-per-lo-sfruttamento-delle-cve-2026-55556-e-cve-2026-61548 2026-09-...

CVE-2026-35048

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...

CVE-2026-35048

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the addslashes protection is bypassed because it checks for getmagicquotesgpc, a function removed i...