PT-2026-66425

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description A low-privileged remote attacker with operator access can upload arbitrary files through the REST endpoint used for firmware updates. This allows for the persistent...

PT-2026-66460

Name of the Vulnerable Software and Affected Versions koku-metrics-operator for Red Hat OpenShift affected versions not specified Description A flaw exists in the CostManagementMetricsConfig custom resource. A user with permissions to edit this resource can specify an arbitrary upload URL. The...

📄 WordPress Pix for WooCommerce 1.5.0 Shell Upload

This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce plugin for WordPress. Attackers can leverage the missing capability check and insufficient file type validation in the lknpixforwoocommercec6savesettings function to upload arbitrary...

PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

CVE-2026-52680: Improper Limitation of a Pathname to a Restricted Directory

Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the REST batch upload endpoint can provide path traversal sequences in the filename and cause the Kyuubi server process to...

CVE-2026-18361: Improper Neutralization of Input During Web Page Generation

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

CVE-2026-18353: Server-Side Request Forgery (SSRF)

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-44097: Unrestricted Upload of File with Dangerous Type

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Denial-of-Service...

PT-2026-66438

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

PT-2026-66459

Name of the Vulnerable Software and Affected Versions koku-metrics-operator affected versions not specified Description A flaw in the CostManagementMetricsConfig custom resource allows a user with edit permissions to specify an arbitrary upload URL. When the authentication.type is set to token th...

PT-2026-66449

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 update2-upload Arbitrary File Upload Vulnerability

This vulnerability allows network-adjacent attackers to upload arbitrary files on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is required to exploit this vulnerability. The specific flaw exists within the update2-upload endpoint. The issue results from the lac...

Exploit for Unrestricted Upload of File with Dangerous Type in Rsjoomla Rsfiles\!

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File...

CVE-2026-66724

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-66724

MWDB Core versions 2.0.0 to 2.18.x contain a missing authorization vulnerability in deprecated config and blob upload endpoints. The undocumented POST method bypasses capability checks that apply to the documented PUT method, allowing any authenticated user without adding_configs or adding_blobs ...

CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-66724

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

EUVD-2026-50358

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-66724

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...

CVE-2026-66724 Permission Bypass Via Undocumented HTTP Methods In MWDB Core

MWDB Core versions =2.0.0 and 2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user...