71057 matches found
CVE-2026-101126
The Joomla Extension - balbooa.com is vulnerable to file metadata tampering in Balbooa Forms versions prior to 2.4.3.4 . The root cause is that the final form submission processes JSON arrays for upload fields while only verifying that IDs are numeric. Because the application trusts client-suppli...
CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
EUVD-2026-64850
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...
GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
CVE-2026-90915
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to arbitrary directory deletion . The root cause is an improper validation of the cache group name, which allows path traversals within the file storage of the caching layer during a cache purge action. This flaw can be exploited to...
EUVD-2026-89088
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
CVE-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
CVE-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
DEBIAN-CVE-2026-102601
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...
CVE-2026-19743
The TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 are vulnerable to a Path Traversal flaw in the local IPC service. Due to improper path validation, a local authenticated user with low privileges can send crafted IPC commands to the service daemon to manipula...
CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...
CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...
OPENSUSE-SU-2026:21970-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...
SUSE-SU-2026:23943-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...
darkly
Darkly Web security project from the 42 cursus. Darkly is a d...
WordPress Core CVE-2026-87902 Page Template LFI/RCE
Exploits CVE-2026-87902 when the active theme contains a page- directory and pearcmd.php is readable with registerargcargv enabled. Stage 1 uses double-encoded pagename traversal to include pearcmd and write a webroot marker; stage 2 executes verifycmd through the dropped PHP file. !/usr/bin/env...
Check Point CVE-2026-93616 Management Detect
Detects exposure to CVE-2026-93616 on Check Point Quantum Security Management SmartConsole/SMS before R82.20 / JHF takes listed in sk1000171. Fingerprints the management web service on TCP/19009 and reachable HTTPS management panels without sending exploit upload payloads. !/usr/bin/env python3 -...