PT-2026-115923

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115856

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file...

PT-2026-115899

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115637

libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso mms/server/mms file service.c accepts an out-of-range initialPosition in fileOpen and stores it in the...

PT-2026-115911

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

CVE-2026-109221: Improper Limitation of a Pathname to a Restricted Directory

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copyfile function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...

PT-2026-115652

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled...

PT-2026-115650

Name of the Vulnerable Software and Affected Versions lomiri-download-manager affected versions not specified Description An incorrect DBus policy in the lomiri-upload-manager component of lomiri-download-manager allows an arbitrary user to read arbitrary files with root privileges over DBus. DBu...

CVE-2026-111458: Heap-based Buffer Overflow

The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...

CVE-2026-96424: Incorrect Permission Assignment for Critical Resource

Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...

Wazuh security monitoring and threat detection Platform Arbitrary File Access

The vulnerability of the uploadlistfile, uploadrulefile, and uploaddecoderfile functions of the Wazuh security monitoring and threat detection platform is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain access t...

WNLTK WekaClassifier File Read Write

The vulnerability of the WekaClassifier module in the NLTK library for symbolic and statistical processing of natural language is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to read...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-115391

Name of the Vulnerable Software and Affected Versions Nezha versions 2.1.0 through 2.3.14 Description The mintTransferTool component fails to validate the Host header when constructing fs.download url and fs.upload url transfer URLs. This allows an attacker to control the Host header in a victim'...

PT-2026-115414

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

PT-2026-115411

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

Apache Camel 4.22.0 Docling SSRF / Local File Disclosure

Apache Camel version 4.22.0 camel-docling contains an input-source confusion flaw that lets attacker-controlled String bodies cause server-side URL fetches or local file reads. The proof of concept demonstrates SSRF and local file disclosure. https://packetstorm.news/download/236040...

Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read

Apache Doris version 4.1.5 JDBC catalog handling permits an attacker-controlled MySQL server to request arbitrary local files from the Frontend host through the MySQL driver's LOCAL INFILE support. The proof of concept demonstrates the issue. !/usr/bin/env python Apache Doris 4.1.5 JDBC Catalog...

PT-2026-115428

The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw file upload function. This is due to missing file extension validation on the attacker-supplied image path parameter, whose basename-derived file name bypasses the...