CVE-2026-10739

The Cato Networks SDP Client for Windows versions prior to 6.12.6 are vulnerable to Local Privilege Escalation . The root cause is the improper validation of a client-supplied SID over a local IPC named pipe . This flaw allows a local user to delete arbitrary files with SYSTEM privileges . No inf...

CVE-2026-10739 Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

EUVD-2026-89779

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

EUVD-2026-89656

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

EUVD-2026-89619

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072

The EWWW Image Optimizer WordPress plugin (versions before 8.8.0 ) contains a vulnerability where a WebP-derivative file migration routine is not properly confined to the site's specific uploads directory. This flaw allows an attacker with Administrator-level access to rename or delete WebP-deriv...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

CVE-2026-91072 EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...

WordPress EWWW Image Optimizer plugin < 8.8.0 - Admin+ WebP File Rename and Deletion vulnerability

Admin+ WebP File Rename and Deletion vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin EWWW Image Optimizer versions 8.8.0...

PT-2026-103124

Name of the Vulnerable Software and Affected Versions Cato Networks SDP Client for Windows versions prior to 6.12.6 Description A local privilege escalation issue exists due to improper validation of a client-supplied Security Identifier SID over a local Inter-Process Communication IPC named pipe...

CVE-2026-96824: Improper Limitation of a Pathname to a Restricted Directory

Editor Arbitrary File Deletion in Template Kit – Import = 1.0.16 versions...

CVE-2026-96823: Missing Authorization

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce = 5.120.0 versions...

CVE-2026-97242: Improper Limitation of a Pathname to a Restricted Directory

Author Arbitrary File Deletion in WEBO MCP = 3.0.18 versions...

CVE-2026-97150: Inclusion of Functionality from Untrusted Control Sphere

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788433791)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788433791 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

Semi-Quantum Cryptography with Certified Deletion

Certified deletion allows a client to upload encrypted data to a server as a quantum state, then later request that the server delete their data and detect whether the server complies. If verification passes, then the data on the server will remain hidden even if the decryption key is later leake...