8770 matches found
CVE-2026-92355
Octopus Server is affected by a path traversal flaw in the handling of non built-in external feeds. A user with low privileges (specifically, permission to modify non built-in external feeds) can exploit this to overwrite arbitrary files on the server. In some configurations, this may escalate to...
CVE-2026-92355
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
EUVD-2026-80225
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-78088
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
EUVD-2026-80098
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
CVE-2026-78088
The Contest Gallery WordPress plugin (Upload & Vote Photos, Media, Sell with PayPal & Stripe) versions up to and including 32.0.1 are affected by an Unauthenticated Arbitrary File Overwrite vulnerability caused by insufficient file path validation in the 'baseUrlForFacebook' parameter . Attackers...
CVE-2026-78088 Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
CVE-2026-73171: External Control of File Name or Path
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote authenticated attacker to overwrite arbitrary files on the device filesystem by uploading a...
PT-2026-93271
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
CVE-2026-78088: Unrestricted Upload of File with Dangerous Type
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
podman -- vulnerabilities
The Podman developers report: This release addresses CVE-2025-11395, where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host. This release also addresses...
CVE-2026-63225: Improper Limitation of a Pathname to a Restricted Directory
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...
CVE-2026-92355: Improper Limitation of a Pathname to a Restricted Directory
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...
CVE-2026-68491
An insufficient check allowed for the overwrite of arbitrary files via a symlink...
CVE-2026-54337
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...
CVE-2026-68491
An insufficient check allowed for the overwrite of arbitrary files via a symlink...
EUVD-2026-80005
An insufficient check allowed for the overwrite of arbitrary files via a symlink...
CVE-2026-68491
SolusVM 1 is affected by an insufficient check that allows the overwrite of arbitrary files via a symlink , enabling a guest-to-host privilege escalation . The vulnerability is scored CVSS 4.0: 9.4 (CRITICAL) with a network attack vector, low complexity, and low privileges required, resulting in ...