PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

CVE-2026-109221: Improper Limitation of a Pathname to a Restricted Directory

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

PT-2026-115652

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

PT-2026-115650

Name of the Vulnerable Software and Affected Versions lomiri-download-manager affected versions not specified Description An incorrect DBus policy in the lomiri-upload-manager component of lomiri-download-manager allows an arbitrary user to read arbitrary files with root privileges over DBus. DBu...

CVE-2026-111458: Heap-based Buffer Overflow

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

CVE-2026-96424: Incorrect Permission Assignment for Critical Resource

Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...

ClickMigrate has Path Traversal in "revision -m" argument

A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executi...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

PT-2026-115414

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

PT-2026-115411

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

Apache Camel 4.22.0 Docling SSRF / Local File Disclosure

Apache Camel version 4.22.0 camel-docling contains an input-source confusion flaw that lets attacker-controlled String bodies cause server-side URL fetches or local file reads. The proof of concept demonstrates SSRF and local file disclosure. https://packetstorm.news/download/236040...

Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read

Apache Doris version 4.1.5 JDBC catalog handling permits an attacker-controlled MySQL server to request arbitrary local files from the Frontend host through the MySQL driver's LOCAL INFILE support. The proof of concept demonstrates the issue. !/usr/bin/env python Apache Doris 4.1.5 JDBC Catalog...

PT-2026-115428

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw file upload function. This is due to missing file extension validation on the attacker-supplied image path parameter, whose basename-derived file name bypasses the...

PT-2026-115536

Name of the Vulnerable Software and Affected Versions DoubleScale | All-in-One CRM versions prior to 1.5.2 Description An arbitrary file upload issue exists in the store upload function. The flaw stems from a fail-open extension allow-list in the extension is allowed function, which returns true...

PT-2026-115443

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8 Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart function. This allows unauthenticated attackers to...

PT-2026-115444

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get cache file dir function concatenating raw, unsanitized ...

PT-2026-115445

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.55 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping during file uploads. Unauthenticated attackers can inject arbitrary web...

PT-2026-115429

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

CVE-2026-109219: Unrestricted Upload of File with Dangerous Type

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only...

CVE-2026-111385: URL Redirection to Untrusted Site

Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...