EUVD-2026-52168

The Webinfos WordPress plugin through 1.2 does not validate the type or name of uploaded files, nor restrict the upload action with any authentication, capability, or nonce check, allowing unauthenticated attackers to upload arbitrary files including PHP to a web-accessible directory, leading to...

nostromo 1.9.6 - Remote Code Execution

nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via directory traversal in the function httpverify. id: CVE-2019-16278 info: name: nostromo 1.9.6 - Remote Code Execution author: pikpikcu severity: critical description: nostromo nhttpd through 1.9.6 allows an...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

DEBIAN-CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

CVE-2026-59652

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

EUVD-2026-52022

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

CVE-2026-59652 LDAP filter injection in legacy jdk1.4 LDAPStoreHelper

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

CVE-2026-59652 LDAP filter injection in legacy jdk1.4 LDAPStoreHelper

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

PT-2026-67245

In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper...

Linux Distros Unpatched Vulnerability : CVE-2026-18651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the...

PT-2026-67455

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no...

PT-2026-67429

Name of the Vulnerable Software and Affected Versions GNU tar affected versions not specified Description A TOCTOU Time-of-Check Time-of-Use issue exists in the incremental dumpdir X rename handling. This occurs when a local attacker with write access to a directory being backed up can influence...

Linux Distros Unpatched Vulnerability : CVE-2026-59652

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java before 1.85, LDAP filter injection in legacy jdk1.4 LDAPStoreHelper. CVE-2026-59652 Note that Nessus relies on the presence of the...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

CVE-2026-13339

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-18352

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2026-13339 CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewpgetsvgcontent' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensiti...

CVE-2026-13339

The CVE-2026-13339 issue concerns the CubeWP Framework WordPress plugin, affected versions are all up to and including 1.1.30. Affected component: cubewp_get_svg_content function, which allows a Directory Traversal. Unauthenticated attackers can read arbitrary server files containing sensitive in...