CVE-2026-111230: External Control of File Name or Path

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

PT-2026-115154

Name of the Vulnerable Software and Affected Versions libsidplayfp versions prior to 3.1.2 Description A heap out-of-bounds read occurs when the software processes a PSID/RSID file with an unchecked data offset. An attacker can set the header data offset beyond the file size, causing the length...

CVE-2026-105032: Unrestricted Upload of File with Dangerous Type

The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...

PT-2026-114976

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the...

CVE-2026-111312: Missing Authentication for Critical Function

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...

PT-2026-115276

Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...

dcm4che 5.35.0 HL7Rcv Path Traversal

dcm4che version 5.35.0 contains a path traversal vulnerability in the HL7Rcv command-line tool. Remote attackers able to send HL7 MLLP messages can write arbitrary files outside the configured storage directory. Advisory ID: SYSS-2026-078 Product: dcm4che Manufacturer: J4Care Affected Versions:...

UBUNTU-CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

UBUNTU-CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

PT-2026-115024

Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/path, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default...

UBUNTU-CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

Improper exception handling vulnerability in QNAP File Station 5

Versions 5.5.x prior to QNAP File Station 5 5.5.6.5243 contain an improper exception handling vulnerability. This vulnerability stems from a null pointer dereference issue; remote attackers can exploit it after gaining access to user accounts to carry out denial-of-service attacks...

CVE-2026-102764: Authentication Bypass by Spoofing

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance...

PT-2026-115173

GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds private that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' propert...

PT-2026-114974

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common name field accepts path traversal sequences and openvpn csc conf write concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The...

UBUNTU-CVE-2026-95125

libming through 0.4.8 contains a heap buffer overflow in rreadc in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause a denial of service...

CVE-2026-108587: Unrestricted Upload of File with Dangerous Type

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

SUSE SLED15: gimp / gimp-devel / gimp-lang / gimp-plugin-aa / libgimp-2_0-0 / etc (SUSE-SU-2026:4653-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4653-1 advisory. This update for gimp fixes the following issue: - CVE-2026-97185: out-of-bounds write in GIMPressionist plugin via...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : YAML-LibYAML vulnerabilities (USN-8925-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8925-1 advisory. Dominique Dumont discovered that YAML-LibYAML did not correctly handle certain reflection...

Unity Linux 20.1070e Security Update: ffmpeg (UTSA-2026-130398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130398 advisory. A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via...