PT-2026-116195

Name of the Vulnerable Software and Affected Versions Tektronix 3 Series MDO versions prior to 1.21.1 Description A path traversal issue exists in the web management interface. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the...

PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

PT-2026-116369

Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.88 Description Insufficient authorization and Cross-Site Request Forgery CSRF checks in a specific action allow authenticated users, including those with subscriber privileges, to perform Server-Side Reques...

ExifTool 12.23 Arbitrary Code Execution

ExifTool versions 7.44 through 12.23 contain an arbitrary code execution vulnerability in DjVu processing. This proof of concept creates a JPEG embedding a crafted DjVu payload that executes a specified command when processed. https://packetstorm.news/download/236124...

Apache Camel FTP 4.22.0 Path Traversal

Apache Camel FTP versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal vulnerability. This proof of concept uses a malicious directory listing to demonstrate access to a file outside the configured polling directory. https://packetstorm.news/download/236116...

CVE-2026-106470: Server-Side Request Forgery (SSRF)

The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscriber, to make the server open connections to arbitrary hosts and ports, including internal ones, and read back the outcome...

CVE-2026-104246: Improper Limitation of a Pathname to a Restricted Directory

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-92798: Improper Control of Generation of Code

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrerurl' branch of URSmartTags::process, where the attacker-controlled HTTPREFERER header is on...

CVE-2026-110253: Improper Limitation of a Pathname to a Restricted Directory

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

CVE-2026-111855: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Dependin...

CVE-2026-111854: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

PT-2026-116194

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

Apache Camel 4.22.0 SFTP Consumer Path Traversal

Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal issue in the mina-sftp consumer. A malicious SFTP server can supply crafted directory-entry names that cause the consumer to access files outside its configured polling directory. Included proof...

NoMachine Redis Improper Authentication Local Privilege Escalation

NoMachine contains an improper authentication vulnerability in its Redis component that allows local attackers to escalate privileges and execute arbitrary code in the service account context...

AlmaLinux 9.6 [TuxCare] Security Update: gvfs / gvfs-client / gvfs-devel / gvfs-fuse / gvfs-goa / etc (ALMALINUX9.6:CLSA-2026:1792194238)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792194238 advisory. - A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to...

CentOS Linux 8.4 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1792238249)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1792238249 advisory. - An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME...

Rocky Linux 9.6 [TuxCare] Security Update: gvfs / gvfs-client / gvfs-devel / gvfs-fuse / gvfs-goa / etc (ALMALINUX9.6:CLSA-2026:1792194238)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792194238 advisory. - A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1792190438)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792190438 advisory. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via...

Rocky Linux 9.6 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792215398)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792215398 advisory. - NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. CVE-2022-2874 - Use After Free in GitHub repository...

Linux Distros Unpatched Vulnerability : CVE-2026-30971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated...