484656 matches found
PT-2026-118342
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
PT-2026-118428
Name of the Vulnerable Software and Affected Versions Vite versions prior to 6.4.4 Vite versions prior to 7.3.7 Vite versions prior to 8.1.6 Vite versions prior to 8.2.4 Vite versions prior to 8.3.3 Description Import analysis may record a root-relative browser URL in safeModulePaths instead of t...
PT-2026-118310
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...
PT-2026-120144
Name of the Vulnerable Software and Affected Versions Imager::File::GIF versions prior to 1.006 Imager affected versions not specified Description An issue exists when consolidating GIF images where palette indices are used without verifying the colour table bounds. Specifically, the i readgif lo...
PT-2026-118599
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can ...
PT-2026-118306
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website...
PT-2026-118287
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...
CVE-2025-60496
The GPAC Project/MP4Box software (versions before 2.5 ) contains a Floating-Point Exception (FPE) in the reframer_send_packet function located at /filters/reframer.c. An attacker can exploit this vulnerability by providing a crafted MP4 file to cause a Denial of Service (DoS) . No specific exploi...
CVE-2025-60496
A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...
AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1791819150)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791819150 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write...
PT-2026-118405
Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description The launchEditor function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus + or minus - sign in the working...
CVE-2025-60494
The GPAC Project/MP4Box software versions before 2.5 is vulnerable to a segmentation violation within the gf_props_equal_internal function located in /filter_core/filter_props.c. An attacker can trigger a Denial of Service (DoS) by supplying a crafted data file . No specific exploit links or reme...
VulnCheck KEV: CVE-2014-125134
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitiv...
PT-2026-118312
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...
PT-2026-118290
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...
PT-2026-118479
OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...
Linux Distros Unpatched Vulnerability : CVE-2026-112390
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...
Linux Distros Unpatched Vulnerability : CVE-2026-111066
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded...
PT-2026-118338
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...