CVE-2026-91806: Use After Free

A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash...

PT-2026-97214

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description The FileOpen plugin fails to properly validate encryption metadata within specially crafted PDF files. This flaw can leave an internal pointer in an invalid state, leading to...

PT-2026-97659

Name of the Vulnerable Software and Affected Versions Drupal Webform versions 6.2.x through 6.3.x Description The Webform module does not sufficiently restrict access to the custom attributes YAML editor. Users with permissions to create or edit webforms, but lacking permissions to edit the webfo...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-162

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently restrict access to the custom attributes YAML editor. Users with permission to create or edit webforms but without permission to edit...

CVE-2026-91810: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

Foxit PDF Editor < 13.2.7 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 13.2.7. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...

Foxit PDF Editor < 14.0.8 / 2026.2.1 Multiple Vulnerabilities

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2026.2.1/14.0.8. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...

CVE-2026-95500

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95697

MISP contains an authorization flaw in the Organisation model's captureOrg method . When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. An authenticated user with at leas...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-95499

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95500 JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95500

JosephChuks php-file-manager-with-code-editor up to version 3.0 is affected by an unrestricted file upload vulnerability in the Save Handler component. The flaw resides in the file_put_contents function within codeEditor.php, where manipulation of the filename/content argument allows a remote att...

EUVD-2026-84426

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95500 JosephChuks php-file-manager-with-code-editor Save codeEditor.php file_put_contents unrestricted upload

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-95499

CVE-2026-95499 affects JosephChuks php-file-manager-with-code-editor up to version 3.0 . The flaw resides in the move_uploaded_file function within filemanager.php , where manipulation of the files argument permits unrestricted file upload by a remote, unauthenticated attacker. The CVSS v3.1 base...

EUVD-2026-84393

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95499 JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95499 JosephChuks php-file-manager-with-code-editor filemanager.php move_uploaded_file unrestricted upload

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...