EUVD-2026-71444

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

PT-2026-86205

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 9.22 ILIAS versions prior to 10.10 ILIAS versions prior to 11.3 Description A SQL injection issue exists in the repository trash table. The system fails to validate the table navigation sort field from HTTP requests...

PT-2026-86224

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem Management interface affected versions not specified Description A missing authorization issue in the management interface allows a user with Admin privileges to escalate their permissions to...

Lutece Core 7.1.7 Remote Code Execution

Lutece Core versions 7.1.7 and below suffer from an authenticated remote code execution vulnerability via XSLT injection. https://packetstorm.news/download/230543...

CVE-2026-75169: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

PT-2026-85518

GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink or email file function accepts parameters prefixed with v file row and appends their values directly to a base directory path without sanitizing for directory traversal sequences...

PT-2026-85517

GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf handle download function accepts parameters prefixed with v del and appends their values directly to the base configuration directory path without sanitizing for...

PT-2026-85421

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

PT-2026-86257

An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

PT-2026-85419

The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root,...

CVE-2026-75169

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

PT-2026-86234

A security flaw has been discovered in jofpin trape 1.0.0/2.0. Affected by this issue is the function join room of the file core/sockets.py of the component Admin Endpoint. The manipulation results in missing authentication. The attack may be launched remotely. The exploit has been released to th...

CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...

GHSA-3MP7-4RH5-JRV9 SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE: This vulnerability corresponds to CVE-2026-72809. Summary The kernel's CheckAuth grants RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1, for a specific set of endpoints, and these localhost bypasses sit outside the accessAuthCode gate so they apply even when an access...

SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE: This vulnerability corresponds to CVE-2026-72809. Summary The kernel's CheckAuth grants RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1, for a specific set of endpoints, and these localhost bypasses sit outside the accessAuthCode gate so they apply even when an access...

CVE-2026-18330

A hard-coded shared RSA-1024 private key vulnerability exists in the web module of the TP-Link Archer AX55 v4 . A LAN attacker who captures an HTTP login session can use the known shared private key to decrypt the administrator password , and a weakened AES session key further reduces the effort ...

CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to...

CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in Web Login in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in TP-Link RE305 V3 and Archer C7 V5. The same RSA-1024 private key is stored within firmware configuration files and reused across devices. An attacker who obtains the private key and captures an HTTP Web UI login session may use the key to...

CVE-2026-78583

Incorrect Authorization CWE-863 in Kibana can lead to privilege escalation via Input Data Manipulation CAPEC-153. Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding...

CVE-2026-85390 Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify...