CVE-2026-16519

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...

EUVD-2026-48512

A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries DLLs from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library locatio...

CVE-2026-16519

Vulnerability overview. CVE-2026-16519 affects the GeoVision GV-IP Device Utility desktop application, where it loads DLLs from an unsafe search path. This DLL search order hijacking allows a local attacker to place a malicious DLL in a location that’s searched before the legitimate library, enab...

CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

SUSE CVE-2026-63771

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

EUVD-2026-48450

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

EUVD-2026-48438

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

PT-2026-64443

Summary The b64 extension inlines images referenced by as base64 data URIs. When resolving the src path it joins it onto the configured base path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base path. A src containing ../ sequences, or an...

PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...

PT-2026-64341

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the scx root enable workfn function during the initialization failure path. The problem occurs because put task structp is called before scx error,...

PT-2026-64317

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download polyhaven asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

PT-2026-64320

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory travers...

ROS-20260724-73-0041

A vulnerability in ImageMagick 7 is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Security update for perl-DBI (important)

openSUSE security update: security update for perl-dbi ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21412-1 Rating: important References: bsc1271399 bsc1271458 bsc1271459 bsc1271629 Cross-References: CVE-2026-15043 CVE-2026-15392 CVE-2026-60081...

Rockwell Automation ThinManager ThinServer Path Traversal (SD1782)

The version of Rockwell Automation ThinManager ThinServer installed on the remote host is 13.0.x through 13.0.7, 13.1.x through 13.1.5, 13.2.x through 13.2.4, or 14.0.x through 14.0.2. It is, therefore, affected by a path traversal vulnerability: - A path traversal vulnerability exists due to...

ROS-20260724-73-0040

The vulnerability in ImageMagick relates to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

PT-2026-64378

Name of the Vulnerable Software and Affected Versions sysPass versions prior to 3.2.12 Description Authenticated administrators can execute arbitrary commands as the web server process user by configuring a malicious backup path and triggering a backup. The FileBackupService constructs a tar shel...

PT-2026-64357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the net2280 USB gadget driver. The usb initialize gadget function sets gadget release as the release callback for the embedded gadget device, meaning the...

CVE-2026-16767

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The...

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...