CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819

Grav CMS prior to 2.0.13 is affected by a remote code execution via the Flex Objects plugin settings validation. Authenticated users can upload a ZIP containing PHP code, bypassing name validation with array notation, triggering unZip on a malicious archive and writing PHP files to the web root f...

GO-2022-1038 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2022-1095 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

WordPress WP Photo Album Plus plugin < 9.2.09.002 - Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability

Subscriber+ Cross-Album File Upload via Missing Authorization vulnerability discovered by Farid Narimanov in WordPress Plugin WP Photo Album Plus versions 9.2.09.002...

EUVD-2026-58555

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19761

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19757

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

SUSE CVE-2026-73228

Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...

EUVD-2026-58549

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

CVE-2026-19757: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-66270: Unrestricted Upload of File with Dangerous Type

Dell Wyse Management Suite WMS, versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution...

CVE-2026-19681: Improper Neutralization of Special Elements used in an OS Command

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system...

CVE-2026-72859: Incorrect Authorization

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

PT-2026-72046

Name of the Vulnerable Software and Affected Versions Dell Wyse Management Suite WMS versions prior to 2605.0.2 Description An unrestricted upload of file with dangerous type allows a high privileged attacker with remote access to potentially achieve Remote Code Execution RCE, which is the abilit...

PT-2026-104467

Уязвимость системы управления интернет-магазином ReadyScript связана с неограниченной загрузкой файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, загружать произвольные файлы...