CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

CVE-2026-104246 Contact Form 7 Signature Addon <= 4.2.2 - Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

EUVD-2026-103250

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

Updated libreoffice package fixes security vulnerabilities

Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality. CVE-2026-63266 LFI and GET SSRF via calcext:data-mappings and csv provider. CVE-2026-63267 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href. CVE-2026-63268 LFI and GET SSRF via...

MGASA-2026-0514 Updated libreoffice package fixes security vulnerabilities

Arbitrary file write via calcext:data-mappings, sql provider and Firebird backup functionality. CVE-2026-63266 LFI and GET SSRF via calcext:data-mappings and csv provider. CVE-2026-63267 LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href. CVE-2026-63268 LFI and GET SSRF via...

CVE-2026-111854

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

EUVD-2026-103207

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

CVE-2026-111854

A path traversal vulnerability exists in the SCPI FILESystem command interface of Tektronix 3 Series MDO devices running firmware versions before 1.21.1 . The root cause is the insufficient validation of file paths supplied to filesystem access commands, which allows remote attackers to read or m...

CVE-2026-111854

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

EUVD-2026-103188

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

EUVD-2026-103187

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

Vulnerability-POC-Dev

Vulnerability-POC-Dev Personal CVE vulnerabilities with autom...

PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

Apache Camel 4.22.0 SMB Consumer Path Traversal

Apache Camel versions from 4.2.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal vulnerability in the SMB consumer that could allow a crafted share listing entry to access, delete, or rename files outside the polled directory...

Rocky Linux 8 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_83525)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683525 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-111802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying wheth...

Linux Distros Unpatched Vulnerability : CVE-2026-102740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12,...

PT-2026-116382

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms delete entry attachments function in all versions up to, and including, 1.6.28 This makes it possible for...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1792190438)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792190438 advisory. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via...

Linux Distros Unpatched Vulnerability : CVE-2026-92877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that...