Exploit for CVE-2026-37065

CVE-2026-37065 Veno File Manager Project 4.4.9 is vulnerable t...

PT-2026-49314

Name of the Vulnerable Software and Affected Versions flatnotes version 5.5.4 Description An arbitrary file upload issue exists in the attachment handling component. This allows attackers to execute arbitrary code by uploading a specially crafted HTML or SVG file. Recommendations At the moment,...

PT-2026-49416

Name of the Vulnerable Software and Affected Versions GeekyBot versions prior to 1.2.3 Description The WordPress GeekyBot plugin allows unauthenticated users to perform arbitrary file uploads. This flaw enables an attacker to upload malicious files to the server without requiring authentication,...

CVE-2026-50873

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file...

CVE-2026-30121

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

PT-2026-49197

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation,...

CVE-2025-68713

The Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) version 23.2.9 is vulnerable to an issue where untrusted applications without permissions can force arbitrary file downloads into the app's scoped storage . Because these files appear in the application's trus...

PT-2026-49198

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload ...

CVE-2026-50877: Improper Limitation of a Pathname to a Restricted Directory

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters...

CVE-2026-40779: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Link Library = 7.8.8 versions...

CVE-2026-39489: Improper Limitation of a Pathname to a Restricted Directory

Author Arbitrary File Download in Download Monitor = 5.1.9 versions...

CVE-2026-39468: Improper Limitation of a Pathname to a Restricted Directory

Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework = 5.11.1 versions...

CVE-2026-45390

In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar1 rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the...

CVE-2026-30121: Write-what-where Condition

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

CVE-2026-40772: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in GeekyBot = 1.2.2 versions...

CVE-2025-68713: Improper Export of Android Application Components

An issue was discovered in Rakuten Send Anywhere File Transfer for Android com.estmob.android.sendanywhere 23.2.9. The vulnerability allows untrusted applications with no permissions to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's...

CVE-2026-39591: Unrestricted Upload of File with Dangerous Type

Subscriber Arbitrary File Upload in WP-BusinessDirectory = 4.0.0 versions...

CVE-2026-30121

remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability...

CVE-2025-68713

An issue was discovered in Rakuten Send Anywhere File Transfer for Android com.estmob.android.sendanywhere 23.2.9. The vulnerability allows untrusted applications with no permissions to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's...

CVE-2026-34026: Relative Path Traversal

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation,...