Directory Traversal

Overview penelope-shell-handler is a Post-exploitation shell handler for authorized security testing Affected versions of this package are vulnerable to Directory Traversal in the download process when extracting tar archives from a remote session without validating archive member paths. An...

GHSA-F42X-P2MX-HM8R Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

CVE-2026-64383

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error within the SMB2flush replay mechanism, occurs when the system attempts to free a memory buffer twice. A malicious SMB server could exploit this by sending a specially crafted flush...

Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 CVSS score: 9.8, which has been described as...

CVE-2026-16463

This CVE affects Autodesk AutoCAD when parsing a malicious DXF file, causing a Heap-Based Overflow in the DXF parser. The underlying flaw can crash the process, read sensitive data, or allow arbitrary code execution in the context of the current process. The CVSS metrics provided indicate a Local...

CVE-2026-16463 DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD

A maliciously crafted DXF file, when parsed through Autodesk AutoCAD, can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2026-65886

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...

CVE-2026-15901

A flaw was found in the Network component of Chromium. A remote attacker could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to heap corruption, potentially allowing the attacker to execute arbitrary code on the affected system...

CVE-2026-65886 Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...

EUVD-2026-50354

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...

CVE-2026-65886 Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox 2.20.2 - The photo viewer allows unauthenticated attackers to view arbitrary files...

CVE-2026-59948

A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...

EUVD-2026-50303

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol...

CVE-2026-0667

CVE-2026-0667 affects Schneider Electric SCADAPack RTUs (47xi, 47x, 57x) and RemoteConnect software. Root cause: insufficient testing of unusual or exceptional states. Attack over Modbus TCP could enable arbitrary code execution, DoS, and loss of confidentiality/integrity with high impact on conf...

CVE-2026-14270

The Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the ecosavesettings function, which allows...

CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...

CVE-2026-65885

CVE-2026-65885 affects Joomla Extension Gridbox

CVE-2026-65885 Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox 2.20.2 - File upload methods allows authenticated attackers to upload arbitrary files. Turns into an authenticated RCE if combined with CVE-2026-65884 as the required account can be created by the attacker...