SUSE CVE-2025-59353

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager's Certificate gRPC service does not...

WordPress Demi – One Click Demo Import, Backup & Site Migration plugin <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability

Unauthenticated Information Exposure to Arbitrary Directory Copy vulnerability discovered by SAHRAOUI AYMEN in WordPress Plugin Demi One Click Demo Import, Backup & Site Migration versions = 0.0.8...

DEBIAN-CVE-2026-59250

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory and potentially achieve remote code execution or a denial-of-service crash by sending a single text-encoded H.248/Megaco message containing an oversized...

CVE-2026-59250

CVE-2026-59250 describes a Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver. During tokenization of Local/Remote descriptors, mfs_load_property_groups extracts an attacker-controlled property name and, when no value follows, formats it into a fixed 512-byte error_msg field u...

CVE-2026-66476

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66050

NitroShare Desktop 0.3.4 is affected by a path traversal flaw in the LAN file transfer server. An unauthenticated network attacker can craft a filename in the JSON item header name field to write arbitrary files outside the transfer root, including into the Windows Startup folder, enabling persis...

CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

CVE-2026-66050 NitroShare Desktop 0.3.4 Path Traversal via LAN File Transfer Server

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field...

CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66476

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

EUVD-2026-49251

Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...

CVE-2026-66476

CVE-2026-66476 affects WordPress with the Easy Digital Downloads plugin (≤ 3.6.9). The vulnerability is described as Administrator Arbitrary File Deletion in affected versions. The provided metrics indicate network access with high privileges required and UI none, resulting in high availability i...

CVE-2026-65436

CVE-2026-65436 affects the WordPress Kirki plugin up to version 6.0.13, with an Editor component vulnerability described as Arbitrary File Deletion. The connected data confirms the affected software/component and the nature of the vulnerability, but does not provide technical steps, exploit detai...

EUVD-2026-49231

Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...

CVE-2026-65436

Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...

CVE-2026-65436 WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability

Editor Arbitrary File Deletion in Kirki = 6.0.13 versions...

CVE-2026-65920

A flaw was found in Diffusers. This path traversal vulnerability in the getcheckpointshardfiles function allows a remote attacker to read arbitrary files. By supplying malicious weightmap values in model index JSON, an attacker can use ../ sequences or absolute paths to escape the model directory...

CVE-2026-57916 Arbitrary Path Execution via CPS URI in proCertum SmartSign

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

CVE-2026-40000

The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths e.g., content://zte.com.cn.filer.fileprovider/rootpath, enabling file access with t...