49024 matches found
PT-2026-81967
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...
PT-2026-82356
An attacker who can set the file name header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0....
CVE-2026-36851
UnPoller v2.33.0 contains a path traversal vulnerability in its password field. In pkg/inputunifi/input.go, any value prefixed with file:// is passed to os.ReadFile() without path validation, allowing an attacker with write access to the up.conf file to specify any readable file on the system. Th...
EUVD-2025-210784
An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...
CVE-2025-61165
Cohere North AI v1.1.5 contains an arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component that allows unauthenticated remote attackers to achieve arbitrary code execution by uploading a crafted file. The CNA-assigned CVSS v3.1 score is 9.8 (Critical) (AV:N/AC:L/PR:N/UI:N/S...
EUVD-2026-66701
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vulnerability:...
Linux Distros Unpatched Vulnerability : CVE-2026-34967
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. A...
PT-2026-82051
Name of the Vulnerable Software and Affected Versions OpenRGB affected versions not specified Description The network protocol in OpenRGB contains a flaw that allows an attacker to write controlled strings into arbitrary file system paths. This issue can lead to a full system compromise if the...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to an unauthenticated arbitrary file download via the downloadDocEx.do interface. An attacker can supply an arbitrary value to the targetPath parameter to download any file from the system without authentication. No specific patch version, mitigation, or confirmed in...
Linux Distros Unpatched Vulnerability : CVE-2026-34968
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database- list drop action fails to validate file extensions...
CVE-2026-36851
Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...
CVE-2026-75328
DocSys-master V2.02.85 is affected by an arbitrary file read vulnerability in the downloadDocEx interface located in src/com/DocSystem/controller/DocController.java. The vulnerability is reachable over the network with no authentication required , yielding a CVSS 3.1 score of 7.5 (HIGH) with high...
CVE-2026-75328
In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnerability:...
PT-2026-81983
EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
PT-2026-81951
Name of the Vulnerable Software and Affected Versions Avada versions prior to 7.16.1 Fusion Builder versions prior to 3.16.1 Description An unauthenticated attacker can achieve remote code execution and complete site compromise by writing attacker-controlled PHP files to the server. This is...
PT-2026-82218
Name of the Vulnerable Software and Affected Versions Mage AI affected versions not specified Description The browser-items API does not restrict accepted paths to the project directory. Specifically, the BrowserItemResource in mage ai/api/resources/BrowserItemResource.py passes caller-supplied...
CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...
CVE-2026-57171
Trestle (compliance-trestle), a Python SDK and CLI for managing OSCAL compliance documents, is affected by an arbitrary file write via path traversal in the catalog-generate, profile-generate, and ssp-generate author commands. The output argument is joined onto the Trestle root but guarded only b...
CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)
Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...
