CVE-2026-111925

Mopidy versions prior to 4.0.5 are vulnerable to a path traversal vulnerability in the File Backend library. The root cause is a missing containment check in the FileLibraryProvider.lookup() function. This flaw allows unauthenticated clients to access local files outside the designated file/media...

EUVD-2026-104317

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...

Exploit for CVE-2026-85250

CVE-2026-85250 — camel-xpath: XML external entity processing...

WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Peter Tang in WordPress Plugin WP Mailster versions = 1.9.1.0...

WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Nixxies in WordPress Plugin Mang Board WP versions = 2.4.4...

USN-8937-1 openssh, openssh-gssapi vulnerabilities

It was discovered that OpenSSH's sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations. CVE-2026-106552 It was discovered that OpenSSH's sshd...

WordPress weForms plugin <= 1.6.28 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Peter Tang in WordPress Plugin weForms versions = 1.6.28...

EUVD-2026-104322

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit h...

EUVD-2026-104325

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0...

CVE-2026-111829 WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Mailster WP Mailster wp-mailster allows PHP Local File Inclusion.This issue affects WP Mailster: from n/a through 1.9.1.0...

CVE-2026-111829

The WP Mailster WordPress plugin (versions

WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by V1T in WordPress Plugin WP Mailster versions = 1.9.1.0...

CLSA-2024-1725187614 kernel: Fix of 12 CVEs

drm/vmwgfx: Fix invalid reads in fence signaled events CVE-2024-36960 - afunix: Fix garbage collector racing against connect CVE-2024-26923 - ipv6: remove maxsize check inline with ipv4 CVE-2023-52340 - aoe: fix the potential use-after-free problem in aoecmdcfgpkts CVE-2023-6270 - smb: client:...

kernel: Fix of 42 CVEs

Bluetooth: hcisysfs: Fix attempting to call deviceadd multiple times CVE-2022-50419 - firewire: net: fix use after free in fwnetfinishincomingpacket CVE-2023-53432 - wifi: brcmfmac: fix use-after-free bug in brcmfnetdevstartxmit CVE-2022-50408 - wifi: brcmfmac: slab-out-of-bounds read in...

GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories

The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by...

libgd: buffer overflow when processing specially crafted GIF file

A flaw was found in libgd. Processing a specially crafted GIF file allows a remote attacker to trigger a buffer overflow, resulting in an application crash and a denial of service. Arbitrary code execution is possible in theory, but considered highly unlikely because standard image decompression...

CVE-2026-98446

A flaw was found in the Linux kernel's XFS file system. When calculating space reservations for file system metadata, the kernel does not prevent an arithmetic underflow if the available reservable blocks drop below the amount already in use. A local user could exploit this condition during file...

Security update for python

This update for python fixes the following issue: CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure bsc1280459. Patch Instructions: To install this SUSE update use the SUSE recommended...

SUSE-SU-2026:4738-1 Security update for python

This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure bsc1280459...

libgd: buffer overflow when processing specially crafted GIF file

A flaw was found in libgd. Processing a specially crafted GIF file allows a remote attacker to trigger a buffer overflow, resulting in an application crash and a denial of service. Arbitrary code execution is possible in theory, but considered highly unlikely because standard image decompression...