WordPress WP File Manager 6.8 Unauthenticated Remote Code Execution

WordPress WP File Manager versions 6.0 through 6.8 expose an elFinder connector that permits unauthenticated arbitrary file upload, enabling remote code execution. This proof of concept checks exposure, uploads a file, or temporarily uploads a shell to run a command...

Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write

Apache Bigtop Manager version 1.1.0 TarballExtractor contains a path traversal vulnerability that allows a malicious service tarball to write files outside the intended extraction directory. !/usr/bin/env python Apache Bigtop Manager 1.1.0 TarballExtractor Arbitrary File Write Vendor: The Apache...

NiceGUI 3.3.1 Path Traversal

NiceGUI version 3.3.1 contains a path traversal vulnerability in App.addmediafiles that allows unauthenticated remote attackers to read arbitrary files. Included proof of concept demonstrates retrieval of a protected lab flag. https://packetstorm.news/download/235842...

dcm4che 5.35.0 Agfa2Dcm Path Traversal

dcm4che version 5.35.0 Agfa2Dcm contains a path traversal vulnerability that allows an attacker supplying an Agfa ARCHIVE-BLOB DICOM file to write extracted data outside the configured output directory. Advisory ID: SYSS-2026-079 Product: dcm4che Manufacturer: J4Care Affected Versions: 5.35.0...

dcm4che 5.35.0 Agfa2SR Path Traversal

dcm4che version 5.35.0 Agfa2SR contains a path traversal vulnerability that allows an attacker-supplied Agfa XML Structured Report to write files outside the configured output directory. Advisory ID: SYSS-2026-080 Product: dcm4che Manufacturer: J4Care Affected Versions: 5.35.0 Tested Versions:...

PT-2026-114766

Name of the Vulnerable Software and Affected Versions OpenSSH affected versions not specified Description A flaw exists in the sftp component where a malicious server can manipulate the local destination path during a copy operation. By supplying an empty name, a slash-only path, or a .. basename...

UBUNTU-CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

Cisco Secure Email Gateway Advanced Malware Protection Privilege Escalation

The vulnerability of the Advanced Malware Protection module of the Cisco Secure Email Gateway protection tool is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain write access to arbitrary files and execute...

CVE-2026-24723: NULL Pointer Dereference

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

PT-2026-115218

Name of the Vulnerable Software and Affected Versions BeyondTrust Remote Support versions prior to 26.2.3 Description Internal messaging components of the product fail to adequately validate the origin of received messages. This improper origin validation allows an unauthenticated remote attacker...

EUVD-2026-102128

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

UBUNTU-CVE-2026-110603

LASzip through 3.5.0 contains an invalid free vulnerability in laszipreadheader that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers can supply a crafted LAS/LAZ file with an inflated VLR count that, when opened and destroyed through the C...

PT-2026-115141

Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260523 Description A heap out-of-bounds read occurs in the libfwsi mtp volume values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP volume she...

UBUNTU-CVE-2026-109763

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-105037: External Control of File Name or Path

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

PT-2026-114817

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

PT-2026-114926

Name of the Vulnerable Software and Affected Versions Enterprise Architect version 17.1 Description The XSLT Debugger feature allows XML External Entity XXE injection. This occurs when the parser processes a crafted XML file containing a DOCTYPE with an external DTD reference, enabling an attacke...

PT-2026-114434

Name of the Vulnerable Software and Affected Versions Ellucian WebAdvisor version 3.2 Description An unauthenticated XML External Entity XXE injection exists, allowing remote attackers to send crafted XML POST requests to the '/WebAdvisor/WebAdvisor' endpoint. This occurs because the system fails...

CVE-2026-106163: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related HTML can execute...

CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...