PT-2026-50307

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

PT-2026-50267

Subscriber Arbitrary File Upload in Grip = 1.0.9 versions...

CVE-2026-40748: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

CVE-2026-40749: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

PT-2026-50475

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 2026.05.1 Description When NC SECURE ATTACHMENTS is set to true, an authenticated uploader can upload .html or .svg attachments that the browser renders inline from the NocoDB origin instead of forcing a download. This...

PT-2026-50320

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-39598: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows Upload a Web Shell to a Web Server. This issue affects Academy LMS Pro: from n/a before 3.5.2...

CVE-2026-39589: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

CVE-2024-52488: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Grip = 1.0.9 versions...

PT-2026-50318

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

PT-2026-50281

Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...

PT-2026-50375

Name of the Vulnerable Software and Affected Versions HCL ZIE for Web affected versions not specified Description HCL ZIE for Web is affected by an unrestricted file upload issue. If the server is configured to execute code, an attacker can upload a web shell—a script used to manage a system...

PT-2026-50489

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.23.1rc0 Description The '/v1/audio/transcriptions' endpoint limits the size of compressed uploads but fails to limit the size of the decoded PCM Pulse Code Modulation output. PCM is an uncompressed digital audio format...

PT-2026-50277

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...

CVE-2026-52705: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

CVE-2025-69129: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site = 1.0.7 versions...

CVE-2026-25446: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WishList Member X = 3.29.0 versions...

PT-2026-50319

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

📄 Discuz! X5.0 Chained Remote Code Execution

This Metasploit module uses race condition and local file inclusion vulnerabilities in Discuz! X5.0 in order to achieve remote code execution. ================================================================================================================================== | Title : Discuz! X5.0...

PT-2026-50457

Name of the Vulnerable Software and Affected Versions Katello of Red Hat Satellite affected versions not specified Description Insufficient authorization checks in the ContentUploadsController within the content upload functionality allow authenticated users with the edit products permission to...