CVE-2026-78587: Incorrect Authorization

Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the activ...

CVE-2026-84695: Improper Neutralization of Input During Web Page Generation

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

Fleet Server 8.19.16, 9.3.5, 9.4.2 Security Update (ESA-2026-164)

Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations Incorrect Authorization CWE-863 in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse CAPEC-122. Fleet Server does not correctly verify session ownership during...

CVE-2026-19118

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-19118 Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-19118

A time-of-check time-of-use (TOCTOU) race condition in GitHub Enterprise Server enabled remote code execution . Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests . All versions prior to 3.22 were affected; fixes are avai...

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

On August 9th, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, discovered an Arbitrary File Upload vulnerability in Gravity Forms, a WordPress plugin estimated to have more than one million active installations. This high-severity vulnerability makes it possible for...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...

CVE-2026-19513

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

CVE-2026-19513 Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

CVE-2026-19513

The Gravity Forms WordPress plugin (all versions ≤ 3.0.2 ) contains an unauthenticated arbitrary file upload vulnerability in the GFAsyncUpload::upload() function. The root cause is insufficient validation of multi-file upload chunk state, where public form state URL hashes can be reused as chunk...

CVE-2026-19513 Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

EUVD-2026-69135

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the GFAsyncUpload::upload function, where public form state URL hashes can be reused as chunk...

CVE-2026-84147

This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by uploading arbitrary files to a web accessible directory on the targeted system...

CVE-2026-84147

Manacle Technologies ERP System is vulnerable to remote code execution due to improper authentication controls and inadequate file type validation at the API endpoint. An unauthenticated remote attacker can upload arbitrary files to a web-accessible directory on the targeted system, enabling arbi...