PT-2026-118680

Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

CVE-2015-20125: Improper Limitation of a Pathname to a Restricted Directory

Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile. Attackers can send GET requests to asposepdfexporterdownload.php with traversal sequence...

CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

PT-2026-118385

Name of the Vulnerable Software and Affected Versions filelock versions prior to 4.2.1 Description In UnixFileLock, a regular file renamed onto the lock path can be truncated if another local user possesses rename permissions or if the file is hard-linked under a permissive hard-link policy...

PT-2026-118324

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...

Linux Distros Unpatched Vulnerability : CVE-2026-112390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...

PT-2026-117951

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL ROOT PASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database acce...

PT-2026-118405

Name of the Vulnerable Software and Affected Versions launch-editor versions prior to 2.14.2 Description The launchEditor function forwards file paths to editors without proper sanitization. If an attacker can create a filesystem entry starting with a plus + or minus - sign in the working...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Summary A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture. Description Apache Paimon's MySQL CDC...

Apache jclouds 2.7.0 XML External Entity (XXE) Injection

Summary Apache jclouds is an open source multi-cloud toolkit for the Java platform that gives you the freedom to create applications that are portable across clouds while giving you full control to use cloud-specific features. The jclouds API gives you the freedom to use portable abstractions or...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-119173

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

CVE-2016-20103: Improper Limitation of a Pathname to a Restricted Directory

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

PT-2026-118338

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

CVE-2014-125133: Improper Limitation of a Pathname to a Restricted Directory

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

Alibaba Cloud Linux 3 : 0312: gstreamer1-plugins-base (ALINUX3-SA-2026:0312)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0312 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-18297: GStreamer OGG File Parsing...

AlmaLinux 9.2 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792490933)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792490933 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...