CVE-2026-48753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

CVE-2026-48753 Incus has an arbitrary file write via path traversal in S3 multipart upload

Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path traversal and allows creation of arbitrary files on the host. This behavior could lead to arbitrary command execution. Version 7.1.0 fixes the issue...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to multer-2.0.1.tgz (CVE-2025-7338 ,CVE-2026-2359 ,CVE-2026-3304 ,CVE-2026-3520)

Summary multer is vulnerable to Uncaught Exception,Missing Release of Resource after Effective Lifetime,Incomplete Cleanup,Uncontrolled Recursion attacks. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2025-7338 DESCRIPTION: Multer is a node.js middleware for...

CVE-2026-77681

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

WordPress Depicter plugin < 4.8.0 - Editor+ Arbitrary File Upload via ZIP Import vulnerability

Editor+ Arbitrary File Upload via ZIP Import vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin Depicter Slider versions 4.8.0...

WordPress Kirki plugin < 6.2.3 - Editor+ Stored XSS via Font Zip Upload vulnerability

Editor+ Stored XSS via Font Zip Upload vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Kirki versions 6.2.3...

WordPress GutenKit plugin < 2.5.0 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin GutenKit versions 2.5.0...

WordPress Admin and Site Enhancements plugin < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC vulnerability

Author+ Stored XSS via SVG Upload over XML-RPC vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Admin and Site Enhancements ASE versions 9.0.1...

EUVD-2026-63876

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681 CodeAstro Online Job Portal update-profile.php unrestricted upload

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681 CodeAstro Online Job Portal update-profile.php unrestricted upload

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/update-profile.php. The manipulation of the argument Name leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-77681

CodeAstro Online Job Portal 1.0 is affected by an unrestricted file upload vulnerability in the file /users/update-profile.php. Manipulation of the Name argument allows a remote, authenticated attacker (low privileges) to upload arbitrary files, leading to low impact on confidentiality, integrity...

WordPress AI Agent by SiteGround plugin <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Media Upload via /generate-content REST Endpoint vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SG AI Studio versions = 1.2.7...

WordPress JetEngine plugin < 3.8.14 - Author+ Stored XSS via SVG Upload vulnerability

Author+ Stored XSS via SVG Upload vulnerability discovered by Erwan LR WPScan in WordPress Plugin JetEngine versions 3.8.14...

BIT-WORDPRESS-MULTISITE-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...

BIT-WORDPRESS-2026-65640

WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A malicious user with the uploadfiles capability This issue affects all versions of WordPress. Versi...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability

Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

WordPress Gift Cards For WooCommerce Pro plugin < 4.2.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Brandon Steed in WordPress Plugin Gift Cards For WooCommerce Pro versions 4.2.10...