CVE-2026-39813

🛡️ CVE-2026-39813 - Fortinet FortiSandbox Path Traversal Vulnerability 📌 Overview CVE-2026-39813 is a critical path traversal vulnerability affecting Fortinet FortiSandbox. The vulnerability arises due to improper validation of user-supplied file paths, allowing attackers to manipulate directory...

PT-2026-141545

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the remove csv file after email send function in all versions up to, and including, 3.6.2 This makes it possib...

CVE-2026-16718

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...

CVE-2026-16718 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...

CVE-2026-16718

IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are impacted by multiple vulnerabilities. A remote authenticated attacker could obtain sensitive information due to improper validation of file paths (CWE-22). The CVSS 3.1 base score is 7.7, reflecting a HIGH sever...

CVE-2026-102435: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient…

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

CVE-2026-92294

The Spectra Gutenberg Blocks WordPress plugin (all versions up to and including 2.20.4 ) is vulnerable to limited file deletion due to insufficient file path validation in the __construct function. This Missing Authorization vulnerability allows unauthenticated attackers to delete theme files on ...

CVE-2026-92294 Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the 'construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to...

EUVD-2026-114577

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the 'construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to...

PT-2026-134434

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the ' construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers t...

CVE-2026-92294: brainstormforce Spectra Legacy – Gutenberg Blocks: The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file…

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the 'construct' function in all versions up to, and including, 2.20.4 This makes it possible for unauthenticated attackers to...

GHSA-7W82-6F9J-V9JP mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic src/utils/validation-utils.js:188-196. As a result, paths such as /home/alice/.ssh/idrsa and...

EUVD-2026-111565

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the uploadfile function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

PT-2026-127779

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the upload file function in all versions up to, and including, 3.8.4 This makes it possible for authenticated attackers, with...

CVE-2026-110253

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

EUVD-2026-103278

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weformsdeleteentryattachments function in all versions up to, and including, 1.6.28 This makes it possible for...

PT-2026-116382

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms delete entry attachments function in all versions up to, and including, 1.6.28 This makes it possible for...

EUVD-2026-98075

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths...

EUVD-2026-98083

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of file paths during archive extraction...

flatpak security update

1.12.9-4.0.1 - Restore the flatpak-builder 1.0.0 subpackage Orabug: 40105180 - Move flatpak-session-helper back into flatpak Orabug: 40105180 1.12.9-4 - Import to OL7 Orabug: 39695281 1.12.9-4 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165633 - Fi...