49322 matches found
EUVD-2026-57216
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name...
CVE-2026-67286
CVE-2026-67286 affects the Joomla extension for SP Page Builder by joomshaper.com prior to version 6.8.0. The issue allows an unauthenticated attacker to create arbitrary directories and write files using a predefined name, enabling potential local impact on the affected site. The provided metric...
CVE-2026-67285
SP Page Builder (Joomla extension) from joomshaper.com is affected by an unauthenticated local PHP file inclusion in versions before 6.8.0. The issue allows an unauthenticated attacker to include arbitrary PHP files accessible by the system. CVSS metrics indicate a high impact on confidentiality,...
CVE-2026-73234
A flaw was found in FreeCAD. An attacker can craft a malicious .FCStd archive that, when opened by a user, exploits a path traversal vulnerability in the PropertyFileIncluded::Restore function. This allows the attacker to write arbitrary files to locations accessible by the FreeCAD user,...
CVE-2026-18048
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...
CVE-2026-15039
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...
EUVD-2026-57095
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...
CVE-2026-18048 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...
CVE-2026-18048 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...
CVE-2026-18048
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server,...
CVE-2026-18048
The WP Photo Album Plus WordPress plugin, prior to version 9.2.07.002, fails to validate a client-controlled value used to build a file path in a public endpoint action and does not perform an authorization check. This allows unauthenticated attackers to delete arbitrary ZIP archives on the serve...
CVE-2026-15039
The CVE-2026-15039 entry concerns the Gift Cards For WooCommerce Pro plugin for WordPress, affected versions prior to 4.2.10. The root cause is that one upload path does not validate the type of uploaded files, allowing unauthenticated users to upload arbitrary files (including PHP code). This ca...
CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...
EUVD-2026-57082
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...
CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...
CVE-2026-15039
The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...
GHSA-MP77-8PGF-MVPR vulnerabilities
Vulnerabilities for packages: chromium...
FreeBSD : gitea -- Multiple vulnerabilities (f4af92f7-95ae-11f1-a6f7-b42e991fc52e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4af92f7-95ae-11f1-a6f7-b42e991fc52e advisory. Gitea reports This release addresses the following security vulnerabilities. Please upgrade as...
PT-2026-71306
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...
Linux Distros Unpatched Vulnerability : CVE-2026-70622
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside t...