CVE-2026-58393

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override commonname field accepts path traversal sequences and openvpncscconfwrite concatenates the value into /var/etc/openvpn-csc// without normalization or a basename check. The...

CVE-2026-52167

A stack overflow in the gensubParsePsb function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service DoS via supplying a crafted .PSB subtitle file...

CVE-2026-85634

A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker...

Kitae Park Mang Board arbitrary file upload vulnerability

Kitae Park’s Mang Board version 2.4.4 and earlier have a vulnerability related to arbitrary file uploads. This vulnerability stems from the mbwfileUpload function, which fails to validate the file extension of the imagepath parameter provided by the attacker. The function relies on the basename o...

Helicalinsight path traversal vulnerability

Helicalinsight 7.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from the path parameter in the getExternalResource function, which allows authenticated users to access files outside of the solution directory. Attackers can provide any readable file with...

Nezhahq Nezha resource management error vulnerability

In versions from 1.0.0 to 2.3.15, there was a resource management error vulnerability in the dashboard file manager. This vulnerability stemmed from the fact that the fmStream in the WebSocket endpoint of the file manager did not call SetReadLimit. As a result, the message size became unlimited,...

Red Hat Enterprise Linux numerical error vulnerabilities

Red Hat Enterprise Linux versions 7, 8, 9, and 10 have a numerical error vulnerability. This vulnerability stems from an integer overflow that occurs during the calculation of the memory buffer size for image dimensions by the GIMP’s file-pvr plugin. Attackers can exploit this vulnerability by...

Openwave Webtop Media Transcoder: Permissions, licensing, and access control issues

Openwave Webtop Media Transcoder versions prior to 1.1.22.0 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from the lack of enforcement of file type restrictions defined by administrators, which may allow authenticated users to bypass the...

Thermo Fisher Scientific Torrent Suite Software path traversal vulnerability

Thermo Fisher Scientific Torrent Suite Software versions 5.18 and earlier have a path traversal vulnerability. This vulnerability allows for attacks due to path traversal, potentially enabling authenticated attackers to access any file accessible by Web service accounts on the Torrent Server...

Red Hat Enterprise Linux Posting Link Vulnerabilities

Red Hat Enterprise Linux versions 10, 7, 8, and 9 have a post-installation link vulnerability. This vulnerability arises because Nautilus does not verify whether the path to the recycle bin directory is a symbolic link when uninstalling or ejecting removable drives or disk images. An attacker can...

IBM i Permission Licensing and Access Control Vulnerabilities

Versions of IBM i 7.3, 7.4, 7.5, and 7.6 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from a lack of subtree checks during file handle parsing, which may allow local attackers to obtain sensitive information...

WHEELS.DEV: Wheel

WHEELS.DEV: In versions 4.0.0 to 4.1.2, there is a vulnerability related to input validation errors. This vulnerability stems from the use of case-insensitive comparisons on a case-sensitive file system. As a result, the checks for standard paths of zip entries, package maps, development...

WordPress ELEX – WordPress HelpDesk & Customer Ticketing System: Arbitrary File Upload Vulnerability

WordPress ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.7 and earlier have an arbitrary file upload vulnerability. This vulnerability stems from the initMailPart function, which does not properly validate the file type when saving IMAP email attachments. This allows unauthorize...

Alexandre Dulaunoy ssldump buffer error vulnerability

Alexandre Dulaunoy’s ssldump 1.9.0 and earlier versions contain a buffer error vulnerability. This vulnerability stems from an error in the calculation of the heap buffer allocation size by the fanxfingerprint function in ssl/sslxprint.c when formatting FAN/X.509 certificate fingerprints...

WordPress YaySMTP arbitrary file upload vulnerability

WordPress versions prior to YaySMTP 2.7.7 have a vulnerability related to file uploads. This vulnerability stems from insufficient file type validation in the putFile function. Additionally, the sanitizefilename function does not remove executable extensions, and it does not apply allowlists, MIM...

ubports lomiri-download-manager: Permissions, licensing, and access control issues

The ubports lomiri-download-manager version from 0.1.0 to 0.3.3 had vulnerabilities related to permission management and access control. These vulnerabilities stemmed from incorrect DBus policies in the lomiri-upload-manager component, allowing any user to read arbitrary files with root privilege...

CoAI.Dev path traversal vulnerability

CoAI.Dev 4.0.0 and earlier versions have a path traversal vulnerability. This vulnerability stems from unvalidated path traversal vulnerabilities in the endpoints for generating and archiving articles. Attackers can use hash query parameters to download arbitrary .tar.gz or .zip files, including...

Nezhahq Nezha resource management error vulnerability

Versions of Nezhahq Nezha from 2.0.13 to 2.3.15 have a resource management vulnerability. This vulnerability stems from the lack of restrictions on concurrent connections at the/api/v1/ws/transfer WebSocket endpoint. Authorized attackers can create numerous ServerTransferClass.Subscribe...

Nezhahq Nezha: Input validation error vulnerability

Versions of Nezhahq Nezha from 2.1.0 to 2.3.15 had a vulnerability related to input validation errors. This vulnerability occurred because the mintTransferTool never validated the construction of Host headers for the fs.downloadurl and fs.uploadurl URLs. This could allow attackers to redirect fil...

MZ Automation GmbH libIEC61850 Digital Error Vulnerability

MZ Automation GmbH’s libIEC61850 versions prior to 1.6.2 have security vulnerabilities. These vulnerabilities stem from the MMS file service accepting an excessive initialPosition during fileOpen and saving it to the file read state. The fileRead path uses unsigned arithmetic to subtract the larg...