23206 matches found
CVE-2026-12036
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...
CVE-2026-12036
The CVE-2026-12036 entry concerns the VantageCoreAddin component used by Lenovo Vantage and Lenovo Commercial Vantage. Description: an improper link following vulnerability could allow a local authenticated user to perform arbitrary file deletion with elevated privileges. The CVSS metrics indicat...
EUVD-2026-58056
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...
CVE-2026-53800 rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...
CVE-2026-53800 rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...
CVE-2026-53800
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...
EUVD-2026-58038
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...
CVE-2026-53800 rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...
CVE-2026-53800
The CVE-2026-53800 issue affects rsync versions before 3.5.0 and concerns a symlink race in the --remove-source-files workflow. An attacker with the ability to create symlinks can time a symlink substitution for a source file between transfer completion and the unlink() call, causing rsync to del...
CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...
CVE-2026-53789
CVE-2026-53789 affects rsync prior to 3.5.0 and describes an improper path handling vulnerability that lets a malicious sender expand the scope of --delete operations to delete files outside the intended destination subtree. The attack is carried out by a crafted file list that can cause rsync to...
CVE-2026-53789
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...
EUVD-2026-58097
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...
CVE-2026-53789 rsync < 3.5.0 Arbitrary File Deletion via Malicious File List
rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-28173
Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...
CVE-2026-19716
Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...
CVE-2026-28189
Unauthenticated Arbitrary File Deletion in Participants Database = 2.7.8.4 versions...
CVE-2026-28189
The CVE-2026-28189 entry concerns the WordPress Participants Database plugin version <= 2.7.8.4, which is affected by an unauthenticated Arbitrary File Deletion vulnerability. The available records indicate the issue arises in this plugin series and can be triggered without authentication, wit...