EUVD-2026-87139

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-42322

The Piwigo open source photo gallery application is vulnerable to Arbitrary Command Execution in versions prior to 16.4.0 . The root cause is located in admin/themes_standard_pages.php, where the application validates uploaded logo content by MIME type but improperly reuses the attacker-controlle...

CVE-2026-42322 Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

CVE-2026-84882

IBM Guardium Data Protection 12.2 is vulnerable to a path traversal vulnerability in the Universal Connector Oracle Wallet upload component (CWE-22). An authenticated remote attacker could exploit this flaw to write arbitrary files to the system. IBM encourages customers to update their systems p...

CVE-2026-84882 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system...

CVE-2026-85750 Piwigo arbitrary file read and remote code execution via insecure image processing

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

BIT-GITLAB-2026-3855 Improper Control of Resource Identifiers ('Resource Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

PT-2026-98951

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob affected versions not specified Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint,...

CVE-2026-97897: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 ...

CVE-2026-93363: Missing Authorization

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

CVE-2026-84882: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system...

PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

CVE-2026-42322: Unrestricted Upload of File with Dangerous Type

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themesstandardpages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from stdpgslogo when constructing the stored filename. An authenticated administrat...

PT-2026-98980

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

PT-2026-98855

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue exists in the Universal Connector Oracle Wallet upload component. This allows an authenticated remote attacker to write arbitrary files to the system. Path traversal ...

PT-2026-98392

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 Description Insufficient file path validation in the upload image function allows authenticated attackers with author-level access or higher to delete arbitrary files on...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-99096

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicio...

CVE-2026-85750: Improper Input Validation

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

Dell Wyse Management Suite < 2605.0.3.683 Multiple Vulnerabilities (DSA-2026-387)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2605.0.3.683. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to WMS 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type...