CVE-2026-53932: Improper Neutralization of Special Elements used in a Command

laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4...

GHSA-8Q3C-RJR9-XXRP VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...

EUVD-2026-63474

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root...

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Summary The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside...

Command Injection

NocoBase is vulnerable to Command Injection. The vulnerability is due to unsanitized interpolation of the database.schema value from crafted backup metadata into shell commands executed with childprocess.exec, which allows an authenticated backup-management user to execute arbitrary commands with...

WordPress JetBackup plugin 3.1.7.9-3.1.23.3 - Subscriber+ Privilege Escalation vulnerability

Subscriber+ Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Backup Guard versions 3.1.7.9-3.1.23.3...

CVE-2026-75135

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-75135 UpSignOn < 7.19.0 Sensitive Key Retention in Memory

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers ca...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84667

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-84667

The Jenkins ThinBackup Plugin (version 2.1.4 and earlier ) is vulnerable to improper access control due to a flaw in Stapler data binding . The plugin incorrectly uses the @DataBoundConstructor annotation on a constructor, which allows the Stapler web framework to invoke @DataBoundSetter annotate...

EUVD-2026-70133

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

CVE-2026-82182 WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ SQLi vulnerability

Admin+ SQLi vulnerability discovered by cyberkareem in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

CVE-2026-82182

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

Security Bulletin: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

Summary IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment. Vulnerability Details CVEID:CVE-2025-33141 DESCRIPTION: IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backu...

SUSE CVE-2026-84134

Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

Improper access control in thinBackup

Jenkins uses the https://github.com/jenkinsci/staplerStapler web framework for HTTP request handling. Stapler's data-binding mechanism instantiates objects by invoking constructors annotated with @DataBoundConstructor, binding submitted data to their arguments, and setting additional properties...

CVE-2026-82182: Improper Neutralization of Special Elements used in an SQL Command

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks...

Linux Distros Unpatched Vulnerability : CVE-2026-84134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...