PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

PT-2026-116369

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.88 Description Insufficient authorization and Cross-Site Request Forgery CSRF checks in a specific action allow authenticated users, including those with subscriber privileges, to perform Server-Side Reques...

CVE-2026-106470: Server-Side Request Forgery (SSRF)

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

CVE-2026-104246: Improper Limitation of a Pathname to a Restricted Directory

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-92798: Improper Control of Generation of Code

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-110253: Improper Limitation of a Pathname to a Restricted Directory

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-111855: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Dependin...

CVE-2026-111854: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

PT-2026-116195

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description A path traversal issue exists in the web management interface. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the...

PT-2026-116363

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description Insufficient input sanitization in the referrer url branch of the UR Smart Tags::process function allows unauthenticated attackers to execute arbitrary registered shortcodes. T...

PT-2026-116194

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

Linux Distros Unpatched Vulnerability : CVE-2026-95121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType in src/atomrtp.cpp. A specially crafted MP4 file can cause...

Rocky Linux 8 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_83525)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683525 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-111458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is...

AlmaLinux 9.2 [TuxCare] Security Update: gvfs / gvfs-client / gvfs-devel / gvfs-fuse / gvfs-goa / etc (ALMALINUX9.2:CLSA-2026:1792186767)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792186767 advisory. - A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to...

AlmaLinux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792215398)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792215398 advisory. - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. CVE-2022-2874 - Use After Free in GitHub repository vim/v...

Linux Distros Unpatched Vulnerability : CVE-2026-81839

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792217772)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792217772 advisory. - vim is vulnerable to Use After Free CVE-2021-4187 - Vim is an open source, command line text editor. Prior to 9.2.0479, a command...

Linux Distros Unpatched Vulnerability : CVE-2026-102946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4,...

Apache Camel 4.22.0 SFTP Consumer Path Traversal

Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal issue in the mina-sftp consumer. A malicious SFTP server can supply crafted directory-entry names that cause the consumer to access files outside its configured polling directory. Included proof...