483638 matches found
EUVD-2026-102208
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...
CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...
CVE-2026-61702
The OpenPrinting CUPS system (prior to version 2.4.20 ) is vulnerable to a root-side banner file disclosure due to a path traversal flaw in scheduler/ipp.c. The copy_banner() function fails to properly sanitize the attacker-controlled IPP attributes-natural-language value used as a directory comp...
CVE-2026-61702 OpenPrinting CUPS: root-side banner file disclosure
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copybanner in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets...
CVE-2026-55480
OpenPrinting CUPS versions prior to 2.4.20 are vulnerable to a symlink TOCTOU (Time-of-Check to Time-of-Use) attack due to the copy_model() function in scheduler/ipp.c . The root cause is the creation of a predictable PPD tempfile path in an lp-group-writable directory without using O_EXCL or O_N...
CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...
EUVD-2026-102205
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...
CVE-2026-55480
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...
CVE-2026-55480
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...
CVE-2026-55480 CUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/.ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...
WordPress Debloat – Remove Unused CSS, Optimize JS plugin <= 1.3.0 - Unauthenticated Arbitrary File Read vulnerability
Unauthenticated Arbitrary File Read vulnerability discovered by Kuba in WordPress Plugin Debloat – Remove Unused CSS, Optimize JS versions = 1.3.0...
WordPress Mang Board plugin <= 2.4.4 - Unauthenticated Arbitrary File Upload vulnerability
Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin Mang Board WP versions = 2.4.4...
EUVD-2026-102198
In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...
CVE-2026-102631
In authd before 0.7.1, the user identity matching in UpdateUser internal/users/manager.go resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provid...
CVE-2026-62679
The photo-management tool Lychee is vulnerable to a path traversal flaw in the SecurePathController component (prior to version 7.6.4 ). The application incorrectly performs a string-prefix check before canonicalizing dot segments when serving GET /image/{path}. Under specific non-default configu...
CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-62679 Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read
Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...
CVE-2026-22812
CVE-2026-22812 Overview A Python exploitation tool for OpenCode Remote Code Execution RCE vulnerability affecting versions v1.0.216. This tool provides multiple attack vectors including command execution, file read/write, file upload/download, and interactive shell. Disclaimer ⚠️ FOR AUTHORIZED...
CVE-2026-58393
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The...