CVE-2026-110877

AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load in src/dmo.cpp that allows attackers to read past a heap allocation by supplying a truncated TwinTeam DMO file. Attackers can supply a 12- or 13-byte file passing dmounpacker::decrypt, opened via...

CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

UBUNTU-CVE-2026-111148

libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that allows attackers to crash applications by supplying a PSID/RSID file with an unchecked data offset. Attackers can set the header data offset beyond the file size, wrapping the length calculation so resolveAddrs reads...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...

UBUNTU-CVE-2026-111134

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files,...

CVE-2026-109221: Improper Limitation of a Pathname to a Restricted Directory

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

CVE-2026-111144

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

CVE-2026-111635: Improper Limitation of a Pathname to a Restricted Directory

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension...

CVE-2026-111613: Missing Authentication for Critical Function

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

CVE-2026-111655: Authorization Bypass Through User-Controlled Key

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with...

PT-2026-115536

Name of the Vulnerable Software and Affected Versions DoubleScale | All-in-One CRM versions prior to 1.5.2 Description An arbitrary file upload issue exists in the store upload function. The flaw stems from a fail-open extension allow-list in the extension is allowed function, which returns true...

PT-2026-116175

Name of the Vulnerable Software and Affected Versions Nautilus affected versions not specified Description An issue exists where Nautilus fails to verify if trash directory paths are symbolic links when a removable drive or disk image is unmounted or ejected. An attacker can exploit this by...

PT-2026-116034

🚨 CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an...

CVE-2026-17073: Improper Access Control

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution...

PT-2026-116135

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Local attackers can obtain sensitive information because the system fails to perform subtree checks during file handle resolution. Recommendations At the moment, there is no information about a newer...

MiracleLinux 8 : lrzsz-0.12.20-46.el8_10 (AXSA:2026-2077:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2077:01 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Linux Distros Unpatched Vulnerability : CVE-2026-110717

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside...

PT-2026-115895

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115907

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115919

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...