CVE-2026-14487

The CVE-2026-14487 entry concerns the WordPress plugin Simple Coherent Form (SCF). Affected versions are all up to and including 2.4.13. The root cause is insufficient file path validation in the removeUploadDir function, enabling unauthenticated deletion of arbitrary server files (e.g., wp-confi...

CVE-2026-14244

The CVE-2026-14244 entry concerns the Jssor Slider WordPress plugin. Vulnerable component: directory traversal via the url parameter in all versions up to 3.1.24. Root cause: improper handling of path input allows unauthenticated attackers to read arbitrary server files containing sensitive infor...

CVE-2026-14244 Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

PT-2026-56321

Name of the Vulnerable Software and Affected Versions WHMCS Bridge versions prior to 7.0 Description The WHMCS Bridge plugin for WordPress contains a flaw allowing arbitrary file uploads. This occurs because the connect function fails to validate file types. Authenticated attackers with...

CVE-2026-47826 - blobs.yaml Path Traversal Allows File Writes | Cloud Foundry

HIGH CVSSv4: High 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSSv3: High 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is HIGH unless otherwise noted. BOSH CLI tool – All versions prior to v7.10.4 Description T...

Joomla Page Builder CK 3.5.10 - Arbitrary File Upload

Exploit Title: Joomla Page Builder CK 3.5.10 - Arbitrary File Upload Google Dork: inurl:compagebuilderck OR "/components/compagebuilderck/assets/pagebuilderck.js" Date: 2026-07-04 Exploit Author: M@rAz Ali Credits: Peyman Siyahi, MR.PERSIA Vendor Homepage: https://www.joomlack.fr/ Software Link:...

VulnCheck KEV: CVE-2026-56291

Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE...

PT-2026-57873

Name of the Vulnerable Software and Affected Versions Glarysoft Glary Utilities affected versions not specified Description A local privilege escalation flaw exists in the Disk Clean functionality. An attacker with low-privileged code execution capabilities on the target system can create a...

PT-2026-56323

Name of the Vulnerable Software and Affected Versions Bulk Order Update for WooCommerce versions prior to 1.7 Description An unauthenticated arbitrary file read exists due to the bouw fetch csv data AJAX handler being registered on the wp ajax nopriv hook without capability or nonce checks. The...

PT-2026-56414

Name of the Vulnerable Software and Affected Versions Blocksy Companion Pro plugin for WordPress versions prior to 2.1.47 Description An unauthenticated arbitrary file upload issue exists within the Advanced Reviews feature. The save attachments function fails to properly validate file extensions...

RockyLinux 10 : python3.14-pip (RLSA-2026:36193)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36193 advisory. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-8643 Tenable has extracted the...

Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Click here to jump to the Simplified Chinese version 点击跳转到简体中文版本 Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Vulnerability Type: Path Traversal CWE-22 / Arbitrary File Read - Affected Product:...

GHSA-4G5X-HCWM-82JW Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise

Click here to jump to the Simplified Chinese version 点击跳转到简体中文版本 Goploy System Arbitrary File Read Vulnerability Basic Information - Vulnerability Name: Goploy Endpoints Arbitrary File Read via Path Traversal - Vulnerability Type: Path Traversal CWE-22 / Arbitrary File Read - Affected Product:...

CVE-2026-55631

DataEase exposes a path-traversal flaw in the font management module prior to version 2.10.24. Authenticated users could submit an arbitrary fileTransName when creating a font record; on deletion, the stored value is concatenated with the font storage directory and passed to FileUtils.deleteFile(...

CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font...

CVE-2026-55631 DataEase: Path Traversal Leading to Arbitrary File Deletion via Font Management

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font...

python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to wri...

GO-2026-5762 Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish

Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish...

GO-2026-5803 Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus

Incus has arbitrary file read+write on host via templates/ symlink in malicious image in github.com/lxc/incus...

GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus

Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus...