CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60496

The GPAC Project/MP4Box software version before 2.5 is vulnerable to a Floating-Point Exception (FPE) within the reframer_send_packet function (located in /filters/reframer.c). An attacker can exploit this vulnerability by supplying a crafted MP4 file to cause a Denial of Service (DoS) . Document...

PT-2026-119046

A segmentation violation in the gf props equal internal function /filter core/filter props.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted data file...

PT-2026-118688

A Floating-Point Exception FPE in the reframer send packet function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

VulnCheck KEV: CVE-2015-20125

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile. Attackers can send GET requests to asposepdfexporterdownload.php with traversal sequence...

VulnCheck KEV: CVE-2016-20103

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

VulnCheck KEV: CVE-2015-20124

Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to asposeimportexportdownload.php with traversal sequences lik...

VulnCheck KEV: CVE-2015-20123

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile. Attackers can send GET requests to asposedocexporterdownload.php with the 'file' parameter set to...

VulnCheck KEV: CVE-2014-125134

ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitiv...

PT-2026-118340

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...

PT-2026-119739

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

PT-2026-118387

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Red Hat: CVE-2026-112177: ghostscript: Reintroduction of .charkeys -dSAFER bypass in RHEL 8

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Summary A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture. Description Apache Paimon's MySQL CDC...

RockyLinux 9 : cockpit-files (RLSA-2026:84595)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:84595 advisory. cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Loc...

Linux Distros Unpatched Vulnerability : CVE-2026-96424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus CVE-2026-96424 No...

BeyondTrust Remote Support (RS) <= 26.2.3 Improper Origin Validation (BT26-05)

The version of BeyondTrust Remote Support RS running on the remote host is prior or equal to 26.2.3. It is, therefore, potentially affected by an improper origin validation vulnerability: - The internal messaging component of BeyondTrust Remote Support RS does not adequately validate the origin o...

Linux Distros Unpatched Vulnerability : CVE-2026-98553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an...