CVE-2026-10094: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server...

CVE-2026-54193: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Fusion Builder = 3.15.4 versions...

CVE-2026-47277: Improper Limitation of a Pathname to a Restricted Directory

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...

CVE-2026-52705: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms = 1.4.5 versions...

CVE-2026-52716: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in WorkScout-Core = 1.7.11 versions...

PT-2026-50318

Subscriber Arbitrary File Upload in Ecommerce Zone = 0.9.7 versions...

PT-2026-50298

Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...

PT-2026-50281

Subscriber Arbitrary File Upload in Restaurt = 1.0.4 versions...

PT-2026-50320

Subscriber Arbitrary File Upload in Charity Zone = 1.1.1 versions...

CVE-2026-40724: Improper Limitation of a Pathname to a Restricted Directory

CP Client Arbitrary File Download in Client Portal Pro = 5.6.2 versions...

CVE-2026-39589: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Webenvo = 0.0.6 versions...

CVE-2026-12565: Improper Limitation of a Pathname to a Restricted Directory

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools e.g. GNU tar which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extractio...

CVE-2026-9690: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

📄 Discuz! X5.0 Chained Remote Code Execution

This Metasploit module uses race condition and local file inclusion vulnerabilities in Discuz! X5.0 in order to achieve remote code execution. ================================================================================================================================== | Title : Discuz! X5.0...

PT-2026-50363

Name of the Vulnerable Software and Affected Versions WP Media folder Addon versions 4.0.1 and earlier Description An unauthenticated arbitrary file download issue exists, allowing an attacker to download files from the server without providing credentials. Recommendations Update WP Media folder...

PT-2026-50319

Subscriber Arbitrary File Upload in Kids Gift Shop = 0.5.4 versions...

PT-2026-50268

Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress = 3.0.2 versions...

PT-2026-50605

Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.5.2 Description Applications that pass user-controlled input to the Handlebars.compile function using a FileTemplateLoader or ClassPathTemplateLoader are susceptible to arbitrary file read. This occurs when web...

CVE-2026-40746: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in Restaurant Zone = 0.7.8 versions...

SUSE: CVE-2026-2604: SUSE Linux Security Advisory

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...