489625 matches found
CVE-2026-96424: Incorrect Permission Assignment for Critical Resource
Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...
CVE-2025-55640
A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
UBUNTU-CVE-2026-111458
The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is computed as strlenb64 + strlenhex + 31, but the format string "fan1:x509:server:passive:%s:sha256:%s" contains 33 fixed characters in...
Red Hat: CVE-2026-85985: mariadb: MariaDB: Unauthorized file access via CONNECT engine functions
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs jsonfile, bsonfile, jfilemake, bfilemake, and jbinfile are affected because each does not enforce FILE privilege or th...
PT-2026-116175
Name of the Vulnerable Software and Affected Versions Nautilus affected versions not specified Description An issue exists where Nautilus fails to verify if trash directory paths are symbolic links when a removable drive or disk image is unmounted or ejected. An attacker can exploit this by...
CVE-2026-111448: Improper Handling of Case Sensitivity
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...
Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read
Summary Apache Doris is a high-performance, real-time analytical database based on the MPP architecture. Known for being efficient, simple, and unified, it returns query results over massive datasets within sub-second latency, and a single system supports both high-concurrency point queries and...
CVE-2026-74923: Exposure of Sensitive Information to an Unauthorized Actor
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed...
PT-2026-115414
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...
Apache Camel 4.22.0 Docling SSRF / Local File Disclosure
Apache Camel version 4.22.0 camel-docling contains an input-source confusion flaw that lets attacker-controlled String bodies cause server-side URL fetches or local file reads. The proof of concept demonstrates SSRF and local file disclosure. https://packetstorm.news/download/236040...
PT-2026-115428
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw file upload function. This is due to missing file extension validation on the attacker-supplied image path parameter, whose basename-derived file name bypasses the...
PT-2026-115536
Name of the Vulnerable Software and Affected Versions DoubleScale | All-in-One CRM versions prior to 1.5.2 Description An arbitrary file upload issue exists in the store upload function. The flaw stems from a fail-open extension allow-list in the extension is allowed function, which returns true...
PT-2026-115443
Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8 Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart function. This allows unauthenticated attackers to...
PT-2026-115444
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get cache file dir function concatenating raw, unsanitized ...
PT-2026-115445
Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.55 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping during file uploads. Unauthenticated attackers can inject arbitrary web...
PT-2026-115429
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the copy file function in all versions up to, and including, 4.9.3 This makes it possible for authenticated attackers, with Sales...
CVE-2026-109219: Unrestricted Upload of File with Dangerous Type
The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbwfileupload function. This is due to missing file extension validation on the attacker-supplied imagepath parameter, whose basename-derived file name bypasses the extension allowlist applied only...
CVE-2026-111385: URL Redirection to Untrusted Site
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.downloadurl and fs.uploadurl transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture...
PT-2026-115479
Name of the Vulnerable Software and Affected Versions Document Gallery WordPress plugin versions prior to 5.1.2 Description The plugin fails to perform capability or ownership checks when generating a gallery on demand. This allows unauthenticated users to enumerate and disclose titles,...
