Malicious Package

Overview a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection...

Malicious Package

Overview alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection betwee...

WordPress Contact Form 7 Signature Addon plugin <= 4.2.2 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Kiran Krishnakumar in WordPress Plugin Contact Form 7 Signature Addon versions = 4.2.2...

gimp: integer overflow when generating a thumbnail preview for a PSD file

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD Photoshop Document image file, an integer overflow occurs during the multiplication of values from an embedded JPEG header. This leads to an undersized heap allocation, resulting in a...

Exploit for Improper Neutralization of Wildcards or Matching Symbols in Laravel Framework

🔐 Penetration Testing su Piattaforma Gestionale Laravel Penetr...

ai.wanaku.sdk:capabilities-runtimes-camel-common (>=0.2.0, <=0.2.2), ai.wanaku.sdk:capabilities-runtimes-camel-plugin (>=0.2.0, <=0.2.2) +379 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-file (>=4.19.0, <=4.22.0)

org.apache.camel:camel-file MAVEN version =4.19.0, =0.2.0, =0.2.0, =2.110.0, =2.74.0, =4.0.0, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =3.2.1, =4.1.0 and more Source cves: CVE-2026-79985 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430834...

ai.wanaku.sdk:capabilities-runtimes-camel-common (>=0.1.1, <=0.1.2), ai.wanaku.sdk:capabilities-runtimes-camel-plugin (>=0.1.1, <=0.1.2) +477 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-file (>=4.2.0, <=4.18.4)

org.apache.camel:camel-file MAVEN version =4.2.0, =0.1.1, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.4, =4.0.1, =4.0.1, =4.0.1, =1.1.0, =1.1.0, =2.73.0 - com.codbex.kronos:codbex-kronos-application 2.71.1 - com.sap.cloud.adk:adapter.api 4.10.2 and more Source cves: CVE-2026-79985 Source...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the process that resolves remote file paths from server directory listings without constraining them to the intended directory. An attacker can access, delete, or rename files outside the designated polling...

CVE-2026-98445

A flaw was found in the Linux kernel's XFS file system. A local user could cause a Denial of Service DoS by triggering an online file system repair under low-memory conditions. When a memory allocation failure occurs during repair block reservation, the kernel cannot cleanly recover from the erro...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the process that resolves remote file paths from server directory listings without constraining them to the intended polling directory. An attacker can access, delete, or rename files outside the intended directo...

BIT-PARSE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2 Denial of Service via File Pointer Without URL

Parse Server before 8.6.95 and 9.0.0 before 9.10.2 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete trigge...

CVE-2026-91858

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-85250

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-79983

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

CVE-2026-79986

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79984

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79985

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file write (CVE-2026-17437)

Summary IBM App Connect Enterprise Toolkit is vulnerable to an arbitrary file write. Vulnerability Details CVEID:CVE-2026-17437 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction...

EUVD-2026-104208

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-85300

The Apache Camel PQC component is vulnerable to Incorrect Default Permissions (CWE-276) in versions 4.12.0 to 4.18.5 and 4.19.0 to 4.22.1. The root cause is that the component writes generated key material to disk using default process umask permissions instead of restricting access to the owner....