CVE-2026-123842

JetBrains IntelliJ IDEA versions prior to 2026.3 are vulnerable to an arbitrary file write vulnerability. The root cause is improper link resolution during the extraction of plugin archives , where symlinks can be leveraged to overwrite files. The security impact is categorized as HIGH for integr...

CVE-2026-123842

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

EUVD-2026-118345

In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives...

CVE-2026-80302 Avast sandbox escape via arbitrary file write in virtualized environment

Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside the sandbox to write arbitrary files outside sandbox containment and execute code on the host. The sandbox virtualizes file system operations by intercepting...

CVE-2026-80302

The Avast sandbox file virtualization layer on Windows suffers from insufficient isolation , allowing a local, low-privileged attacker executing inside the sandbox to perform an escape. The root cause is a failure to properly validate write targets in specific edge cases, which allows the attacke...

CRM Platform Path Traversal DoS

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

Enlogic SCADA Virtual Controller File Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to incorrect external control using filenames or paths. Exploiting this vulnerability could allow a malicious actor to delete any files at will...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

CVE-2026-92895

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

CVE-2026-114630

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-92895

The Live2DWebCanvas plugin for WordPress (versions up to and including 2.2.1 ) is vulnerable to Unauthenticated Arbitrary File Upload via the download_one_file function. The root cause is a lack of file extension whitelisting and MIME type validation when writing files from attacker-controlled ma...

CVE-2026-92895 Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

EUVD-2026-118196

The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the downloadonefile function. This is due to missing file extension whitelist and MIME type validation in downloadonefile when writing files derived from...

CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

CVE-2026-114630

The ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions

EUVD-2026-118189

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete...

VEN0m-Ransomware

VEN0m Ransomware https://github.com/user-attachments/assets/5a1fc9b5-a647-41f6-a152-7b9d97381adc This project demonstartes how a legit, and signed driver can be weponized to evade defenses and deploy ransomware simulating a real cyberattack. 🚨 Tested on Windows 11 Pro 24H2. Fully undetectable as ...

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 3.2.14 . The root cause is the plugin's failure to properly verify user permissions for specific actions. This flaw allows unauthenticated attackers to write arbitrary ...

Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

Ghost Arbitrary File Read Exploit CVE-2023-40028 Overview This script exploits a vulnerability in Ghost CMS CVE-2023-40028 to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system. Features ...