49458 matches found
PT-2026-63853
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
GHSA-XMC9-4F2H-JF9C n8n: Edit Image Node Format Injection Allows Arbitrary File Write
Impact The n8n Edit Image node passed its output format to the underlying image library without validation, so a crafted value could write bytes to a location outside the node's working directory. An authenticated user able to run workflows could use this to write arbitrary files in the n8n...
GHSA-2X35-3FW4-9JR4 n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
Impact The n8n Send Email node did not enforce that its message fields were strings, so a crafted untrusted non-string value from a workflow expression could be treated by the underlying mail library as a file path or URL. This could allow disclosure of local files on the n8n host. Exploitation...
WordPress WP Encryption – Lifetime Free SSL Cert & HTTPS, Force SSL / HTTPS Redirect, SSL Security plugin <= 7.8.6.6 - Authenticated (Administrator+) Arbitrary File Write vulnerability
Authenticated Administrator+ Arbitrary File Write vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions = 7.8.6.6...
CVE-2026-42305
A flaw was found in Dulwich, a pure-Python implementation of the Git file formats and protocols. A remote attacker could exploit this vulnerability by enticing a user on a Windows system to clone or check out a specially crafted malicious Git repository. This could lead to an arbitrary file write...
CVE-2026-63048
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE...
CVE-2026-63048 Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.11, 3.5.0-3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE...
CVE-2026-63048
Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 3.6.2 - The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE...
CVE-2026-15802
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-15802
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...
CVE-2026-15802
The CVE covers the WP Foodbakery WordPress plugin. Affected: all versions up to 4.9. Vulnerability: arbitrary file deletion due to insufficient validation in delete_locations_backup_file_callback. Impact: authenticated attackers with subscriber-level access can delete arbitrary files on the serve...
CVE-2026-15802 WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...
EUVD-2026-47611
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...
EUVD-2025-210497
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...
PT-2026-63330
Name of the Vulnerable Software and Affected Versions Page Builder CK versions prior to 3.6.2 Description An improper access control issue allows authenticated users to perform an arbitrary file upload, which can lead to Remote Code Execution RCE, a state where an attacker can execute arbitrary...
PT-2026-71452
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description An arbitrary file overwrite issue exists in the Diffable.diff method due to insufficient validation of git options passed through kwargs. An attacker can use the --output argument via the other...
SUSE CVE-2026-58624
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute g...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access internal network resources, cloud metadata endpoints, or read arbitrary local...
CVE-2026-47731
Summary (validated by connected docs): CVE-2026-47731 affects the NASA AMMOS AIT-Core software’s Binary Stream Capture (BSC) component. An unauthenticated HTTP API under /NAME/start allows a remote attacker to trigger path traversal by supplying attacker-controlled fields (log_dir_path, path, fil...