EUVD-2026-49755

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

CVE-2026-63302

Quick.CMS is vulnerable to Local File Inclusion LFI in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure...

Security update for apache-sshd

This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...

SUSE-SU-2026:3339-1 Security update for apache-sshd

This update for apache-sshd fixes the following issues: Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send filenames that lead to arbitrary file writes due to a path traversal issue in the sshd-scp component of Apache MINA SSHD. bsc1272158...

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

BIT-THRIFT-2026-58389 Apache Thrift: Rust binary protocol non-strict path missing string size limit

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

BIT-THRIFT-2026-58023 Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path

Out-of-bounds Read vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-14490

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

USN-8617-1 linux-kvm vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

CVE-2026-59924

A flaw was found in Mistune, a Python Markdown parser. The Include.parse function does not properly verify user-supplied include paths, allowing an attacker to craft paths that can access files outside the intended markdown directory. This can lead to information disclosure when markdown files ar...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

EUVD-2026-49697

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16585 Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

CVE-2026-16585

Technical details (affected versions, root cause, impact, and fixes) are not publicly available in the provided documents; monitor for updates.

CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-17524

The CVE-2026-17524 entry concerns the zip-lib package for Node.js, with versions before 1.1.0 vulnerable to Directory Traversal during extraction via the caching path-validation logic. The root cause is that the isOutsideTargetFolder check is only performed when the initial directory symlink is c...