PT-2026-115074

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description The PropertiesBasedResumableProcessor stores resumable download state at a predictable shared path...

PT-2026-115276

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...

CVE-2026-111134: Out-of-bounds Read

libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsimtpfileentryvaluesreaddata that allows attackers to read past buffer bounds via crafted MTP file entry shell items. Attackers can embed a 10 to 73 byte shell item with item data size of 44 or more in .lnk files,...

PT-2026-115140

Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260522 Description A heap out-of-bounds read occurs in the libfwsi mtp file entry values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP file...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-24721: NULL Pointer Dereference

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

PT-2026-115150

Name of the Vulnerable Software and Affected Versions libansilove versions 1.3.0 through 1.4.2 Description A NULL pointer dereference occurs in the ansilove xbin function when processing a specially crafted XBIN file. An attacker can trigger this by setting the 512-character flag while omitting t...

WordPress Bricksforge 3.1.8.9 Shell Upload

WordPress Bricksforge plugin versions through 3.1.8.9 contain an unauthenticated arbitrary file upload flaw that can result in PHP code execution. The included proof of concept demonstrates the issue with a GIF/PHP marker polyglot. https://packetstorm.news/download/235859...

PT-2026-115195

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services dyndns edit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-111234: External Control of File Name or Path

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-108587: Unrestricted Upload of File with Dangerous Type

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

PT-2026-115224

Name of the Vulnerable Software and Affected Versions EnergizeLab station-middleware NestJS Docker images versions 1.6.5 through 1.8.2 Description Low-privilege registered accounts can read arbitrary files from the server by providing a controlled file path. This issue allows unauthorized access ...

PT-2026-115199

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file get contents to read...

CVE-2026-110874: Deserialization of Untrusted Data

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize in functions.lib.php, which calls unserialize without class restrictions when jsondecode fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized...

PT-2026-115173

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds private that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' propert...

CVE-2026-111144: NULL Pointer Dereference

libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilovexbin that allows attackers to crash applications by supplying a crafted XBIN file. Attackers can set the 512-character flag without the custom-font flag, causing drawchar to index a NULL highfontdataxbin...

dcm4che 5.35.0 HL7Rcv Path Traversal

dcm4che version 5.35.0 contains a path traversal vulnerability in the HL7Rcv command-line tool. Remote attackers able to send HL7 MLLP messages can write arbitrary files outside the configured storage directory. Advisory ID: SYSS-2026-078 Product: dcm4che Manufacturer: J4Care Affected Versions:...

PT-2026-114972

A stack overflow in the gensub ParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

PT-2026-114976

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-85634: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker...