CVE-2026-19991

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-19991

CVE-2026-19991 affects the UsersWP WordPress plugin in versions up to and including 1.2.70 , allowing authenticated attackers with Subscriber-level access or higher to perform arbitrary file deletion via the upload_file_remove() AJAX handler. The root cause lies in a validation bypass: the plugin...

EUVD-2026-75939

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

CVE-2026-19991 UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...

EUVD-2026-75761

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

EUVD-2026-75770

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

EUVD-2026-75764

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

EUVD-2026-75787

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

EUVD-2026-75775

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

EUVD-2026-75773

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

EUVD-2026-75772

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

EUVD-2026-75782

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

EUVD-2025-210887

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2026-77807

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

EUVD-2025-210892

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

PT-2026-90508

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean uri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

PT-2026-90041

🚨 CVE-2026-87719 GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and...

PT-2026-90513

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

Fedora 45 : composer (2026-249d41312c)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-249d41312c advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

Linux Distros Unpatched Vulnerability : CVE-2026-88014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend...