CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16616

CVE-2026-16616 affects the Simple File List WordPress plugin through version 6.3.11 . The root cause is a missing validation of the source path in a file-move operation that is reachable by unauthenticated users. This allows an attacker to read arbitrary files on the server (sensitive information...

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 lacks capability checks in several file management AJAX actions, specifically via the fma_load_fma_ui handler. Any user with file-manager access (as low as Subscriber ) can read arbitrary files on the server—including sensitive configuratio...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-11565 Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

CVE-2026-19942

The Atarim WordPress plugin (≤5.1.1) allows authenticated author-level attackers to delete arbitrary server files. The root cause is insufficient file path validation in AVCF_Abilities_Media::register's replace-media-file execute_callback. Attackers first use atarim/update-post-field to set _wp_a...

CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...

GHSA-PWGV-4X5Q-6M9F vulnerabilities

Vulnerabilities for packages: mlflow, mycli, airflow...

PT-2026-78448

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root path type could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token...

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

CentOS 9 : python3.9-3.9.25-10.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.25-10.el9 build changelog. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

PT-2026-78646

Name of the Vulnerable Software and Affected Versions Logto Tunnel versions prior to 0.3.9 Description The Logto Tunnel npm package contains a flaw where the createStaticFileProxy function in packages/tunnel/src/commands/tunnel/index.ts processes static asset requests using path.joinstaticPath,...

Linux Distros Unpatched Vulnerability : CVE-2026-17106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...

PT-2026-78771

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can write dispatch...

PT-2026-78285

Name of the Vulnerable Software and Affected Versions Simple File List WordPress plugin versions prior to 6.3.12 Description Unauthenticated users can exploit a lack of validation in the source path of a file-move operation. This allows an attacker to read arbitrary files on the server and reloca...

PT-2026-78366

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...

PT-2026-78780

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can delete arbitrary...

PT-2026-78442

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to...