PT-2026-118479

OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that undersizes the scanline buffer, causing a heap out-of-bounds read. Attackers can supply a crafted Cineon file with a huge declared width that wraps the size...

Pedro Marcelo Issuu Panel code injection vulnerability

Versions prior to 1.6.6 of Pedro Marcelo Issuu Panel contain a code injection vulnerability. This vulnerability stems from a PHP file inclusion flaw: unauthenticated attackers can send a GET request to menu/documento/requests/ajax-docs.php with a specially crafted abspath parameter. This paramete...

PT-2026-118669

Name of the Vulnerable Software and Affected Versions X2000R version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 Description An arbitrary file write issue exists in the boa formUploadFile functionality. An authenticated attacker can send a specially crafted HTTP request to write files to the system,...

CVE-2014-125133: Improper Limitation of a Pathname to a Restricted Directory

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

EyeLock nano NXT path traversal vulnerability

EyeLock nano versions 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability. This vulnerability stems from improper handling of the “path” parameter. Unauthenticated attackers can craft path traversal sequences to read arbitrary files, potentially leading to local...

Imithemes NativeChurch path traversal vulnerability

Versions prior to 1.6.2 of imithemes NativeChurch contain a path traversal vulnerability. This vulnerability allows unauthenticated attackers to send GET requests containing directory traversal sequences via the file parameter in download.php. As a result, they can download arbitrary files and...

ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

CVE-2025-60496

The GPAC Project/MP4Box software version before 2.5 is vulnerable to a Floating-Point Exception (FPE) within the reframer_send_packet function (located in /filters/reframer.c). An attacker can exploit this vulnerability by supplying a crafted MP4 file to cause a Denial of Service (DoS) . Document...

VulnCheck KEV: CVE-2016-20103

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

VulnCheck KEV: CVE-2016-20101

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value...

VulnCheck KEV: CVE-2015-20123

Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile. Attackers can send GET requests to asposedocexporterdownload.php with the 'file' parameter set to...

Totolink X2000R boa formUploadFile arbitrary file write vulnerability

Summary A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Apache Paimon versions 2.1.0 and 2.0.0 MySQL CDC synchronization actions allow user-supplied JDBC properties that can enable a rogue MySQL server to request arbitrary local files from the CDC process. !/usr/bin/env bash Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read Vendor: The Apache Software...

PT-2026-120321

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Summary A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture. Description Apache Paimon's MySQL CDC...

PT-2026-118679

Name of the Vulnerable Software and Affected Versions Aspose Doc Exporter plugin for WordPress versions prior to 2.0 Description An issue allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to the readfile function. This is achieved by sending GET requests to...

PT-2026-118402

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations. This behavior allows a local user to repla...

CVE-2016-20103: Improper Limitation of a Pathname to a Restricted Directory

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4738-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4738-1 advisory. This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic...

AlmaLinux 10 : gd (ALSA-2026:81518)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:81518 advisory. libgd: buffer overflow when processing specially crafted GIF file CVE-2026-9672 Tenable has extracted the preceding description block directly from the AlmaLinux...