CVE-2026-103476 yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

CVE-2026-46711

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-94123

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

EUVD-2026-89840

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

CVE-2026-94123 WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

CVE-2026-94123 WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

CVE-2026-94123

The NextGEN Gallery plugin for WordPress (versions

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-85415

The Audio Player Block WordPress plugin, in versions prior to 1.6.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to validate the scheme of a user-supplied URL before using it as a link target. This allows users with the Contributor role or higher to store mal...

CVE-2026-85415 Audio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL

The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...

CVE-2026-103476: Authorization Bypass Through User-Controlled Key

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

AlmaLinux 9.2 [TuxCare] Security Update: wget (ALMALINUX9.2:CLSA-2026:1784310537)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784310537 advisory. - GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within...

PT-2026-103594

Name of the Vulnerable Software and Affected Versions Inspur Haiyue HCM Cloud affected versions not specified Description An arbitrary file read issue exists in the '/api/model report/file/download' endpoint. Unauthenticated remote attackers can read arbitrary files by providing unvalidated path...

CVE-2024-58387: Improper Limitation of a Pathname to a Restricted Directory

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

CVE-2026-94123: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

PT-2026-103610

Name of the Vulnerable Software and Affected Versions bisheng versions 2.3.0 through 2.4.0 Description A directory traversal issue exists in the save download file function located in src/backend/bisheng/core/cache/utils.py:290. Directory traversal is a flaw that allows an attacker to access file...

PT-2026-103462

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

PT-2026-103172

Unauthenticated Arbitrary File Download in NextGEN Gallery = 4.5.0 versions...

PT-2026-103501

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve files from unpublished articles without...

AlmaLinux 9.6 [TuxCare] Security Update: wget (ALMALINUX9.6:CLSA-2026:1784136800)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784136800 advisory. - GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parsecontentrange function within...