SUSE CVE-2026-27660

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission...

PT-2026-94192

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

PT-2026-94193

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

CVE-2026-87254

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87258

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87258

Oracle Agile PLM (Oracle Supply Chain) is affected in component Folders, Files & Attachments on supported version 9.3.6 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires human interaction from a user other than the att...

EUVD-2026-79911

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-87254

CVE-2026-87254 affects Oracle Agile PLM (product of Oracle Supply Chain), specifically the Folders, Files & Attachments component, in supported version 9.3.6 . The vulnerability is difficult to exploit but allows a low-privileged attacker with network access via HTTP (no user interaction required...

EUVD-2026-79908

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-68533

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

EUVD-2026-79144

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permission, which was only checked after the file had been stored. A user denied that permission, or an unauthenticated visitor on a guest-postin...

CVE-2026-87258: Improper Access Control

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

CVE-2026-83163: Improper Access Control

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Attachments / File Upload. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

PT-2026-93079

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Folders, Files & Attachments component of the Oracle Agile PLM product. A low privileged attacker with network access via HTTP can compromise the system, provided there is human...

CVE-2026-87254: Improper Access Control

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Folders, Files & Attachments. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful...

PT-2026-93076

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Folders, Files & Attachments component of the Oracle Agile PLM product. A low privileged attacker with network access via HTTP can exploit this flaw to compromise the system,...

Astra Linux – Vulnerability in exim4

In versions of Exim up to 4.97.1, Misparse processes multi-line RFC 2231 header filenames. As a result, remote attackers can bypass the protection mechanism that blocks $mimefilename extensions, and potentially deliver executable attachments to the mailboxes of end users...

Astra Linux – Vulnerability in Thunderbird

When saving or opening an email attachment on macOS, Thunderbird did not set the “com.apple.quarantine” attribute on the received file. If the received file was an application and the user attempted to open it, the application would be started immediately, without asking the user to confirm. This...

Astra Linux – Vulnerability in Thunderbird

Thunderbird allows the use of the Text DirectionOverride Unicode Character in filenames. As a result, an email attachment might be incorrectly displayed as a document file, when in fact it is an executable file. Older versions of Thunderbird will remove this character and display the correct file...

Astra Linux – Vulnerability in dovecot

Dovecot has provided a script that can be used for attaching files during text conversion. However, this script handles zip-style attachments in a way that is unsafe. An attacker could use specially crafted OOXML documents to cause unintended files on the system to be indexed, thereby ending up i...