CVE-2026-54613: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54520: Improper Limitation of a Pathname to a Restricted Directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-53555: Improper Neutralization of Input During Web Page Generation

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an image/svg+xml assistant UI logo through PATCH /api/v1/system/assistant/ui, and SQLBot stores the SVG without sanitizing or validating embedded active content...

CVE-2026-52483: Improper Neutralization of Special Elements used in an OS Command

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BRg8.101.11WVK.0b46 allow authenticated users execute arbitrary OS command via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi...

CVE-2026-45143: Improper Neutralization of Input During Web Page Generation

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-92980: Unrestricted Upload of File with Dangerous Type

HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as the web server user by abusing the Import/Export functionality. Attackers can leverage the Import/Export feature, which is intended solely...

CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-93013: Improper Limitation of a Pathname to a Restricted Directory

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-92894: Incorrect Authorization

A flaw was found in the foremanansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by ID without verifying it belongs to an AnsibleVariable the caller is authorized to edit. An authenticated user with the editansiblevariables permission can dele...

CVE-2026-87831: Missing Authorization

The Checkout Field Manager Checkout Manager for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users...

CVE-2026-91009: Cross-Site Request Forgery (CSRF)

The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products...

CVE-2026-86311: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, and including, 1.8.44 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

PT-2026-95179

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...

PT-2026-94192

Name of the Vulnerable Software and Affected Versions Checkout Field Manager Checkout Manager for WooCommerce WordPress versions prior to 7.9.7 Description An issue exists where the software fails to properly validate the ownership of an attachment before deletion. This allows any authenticated...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...

PT-2026-105483

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h85j-hv3c-qfgq. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM i...

CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

PT-2026-95137

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An authenticated uploader can upload an image/svg+xml assistant UI logo via the 'PATCH /api/v1/system/assistant/ui' endpoint. The system stores the SVG without sanitizing or validating embedded active...

PT-2026-94138

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the shortcode attributes...