86246 matches found
CVE-2026-8287 Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software
Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026...
CVE-2026-8287
The CVE-2026-8287 entry describes an allocation-of-resources-without-limits or throttling vulnerability in BizimHesap Information Systems’ Online Pre-Accounting Software, affecting the product through version 17072026. The concise impact indicates potential availability impact (CVSS v3.1: 4.3, ME...
CVE-2026-65690
Bold Reports Standalone Report Designer, versions before 14.1.12, is affected by a path traversal vulnerability in the file upload feature due to missing filepath validation. This allows an authenticated attacker to supply a crafted filename to traverse outside the intended directory and potentia...
EUVD-2026-48282
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...
CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...
CVE-2026-65690 Bold Reports Standalone Report Designer < 14.1.12 Path Traversal RCE via File Upload
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...
CVE-2026-65690
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal...
CVE-2026-65461
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
CVE-2026-65455
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
CVE-2026-27064
Editor Arbitrary File Upload in Mailster = 4.1.17 versions...
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch SummaryThe uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or ...
PYSEC-2026-3485 meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
Server-Side Request Forgery SSRF in uploadadimage via Unrestricted imageurl Fetch Summary The uploadadimage MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled imageurl parameter directly to an HTTP fetch helper httpx.AsyncClientfollowredirects=True.geturl without any scheme, host, or...
PYSEC-2026-3466 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...
CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
CVE-2026-65461
The WordPress plugin Really Simple CSV Importer (vulnerable:
CVE-2026-65461 WordPress Really Simple CSV Importer plugin <= 1.3 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
EUVD-2026-48225
Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...
CVE-2026-65455 WordPress MapSVG plugin <= 8.14.0 - Arbitrary File Upload vulnerability
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
CVE-2026-65455
CVE-2026-65455 affects the WordPress MapSVG plugin up to version 8.14.0. The vulnerability is described as an Administrator Arbitrary File Upload, with an overall CVSSv3.1 base score of 9.1 (CRITICAL) and a network attack vector, requiring high privileges and no user interaction. The reports do n...