CVE-2026-70426

The Remoting component (versions 3384.v60d89463d9e0 and earlier, excluding 3355.3357.v931d3c992987 ) included in Jenkins versions 2.575 and earlier (and LTS 2.568.1 and earlier) is vulnerable to a deserialization filter bypass. The root cause is that the JEP-200 class filter is not applied to cla...

EUVD-2026-53569

In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...

CVE-2026-40314: Missing Authorization

NamelessMC is website software for Minecraft servers. In version 2.2.4,core/classes/Misc/ProfilePostReactionContext.php only verifies that the wall post exists and does not enforce blocked/private-profile visibility. modules/Core/queries/reactions.php allows unauthenticated GET requests for...

CVE-2022-46945

Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php...

CVE-2019-11515

core/classes/dbbackup.php in Gila CMS 1.10.1 allows admin/dbbackup?download= absolute path traversal to read arbitrary files...

PT-2019-12348

Name of the Vulnerable Software and Affected Versions Gila CMS version 1.10.1 Description The issue allows for absolute path traversal, enabling the reading of arbitrary files. This is possible through the admin/db backup?download= endpoint in the core/classes/db backup.php file. The download...

PT-2017-13324

Name of the Vulnerable Software and Affected Versions TYPO3 versions 7.6.0 through 7.6.21 TYPO3 versions 8.0.0 through 8.7.4 Description The issue allows remote authenticated users to upload files with a .pht extension, which can lead to the execution of arbitrary PHP code due to an Unrestricted...