CVE-2026-111311: Unrestricted Upload of File with Dangerous Type

The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP & More plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.5.1 via the storeupload function. This is due to a fail-open extension...

CVE-2026-111655: Authorization Bypass Through User-Controlled Key

ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with...

CVE-2026-103768: Unrestricted Upload of File with Dangerous Type

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possibl...

CVE-2026-111728: Improper Neutralization of Argument Delimiters in a Command

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-111384: Allocation of Resources Without Limits or Throttling

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:i...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

Red Hat: CVE-2026-104715: cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...

Wazuh security monitoring and threat detection Platform Arbitrary File Access

The vulnerability of the uploadlistfile, uploadrulefile, and uploaddecoderfile functions of the Wazuh security monitoring and threat detection platform is related to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain access t...

CVE-2025-55640

A heap buffer overflow exists in the stbl_AddSize function (located in isomedia/stbl_write.c) of GPAC MP4Box v2.4 . This vulnerability allows an attacker to trigger a Denial of Service (DoS) by providing a crafted MP4 file . While the root cause is a heap-based overflow, the documents do not prov...

PT-2026-115443

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8 Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart function. This allows unauthenticated attackers to...

UBUNTU-CVE-2026-102740

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path...

PT-2026-115411

Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...

PT-2026-115414

Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the CI runner during builds. Package removal and destroy paths can delete...

Linux Distros Unpatched Vulnerability : CVE-2026-85985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugi...

PT-2026-115919

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

PT-2026-115895

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege...

MiracleLinux 8 : lrzsz-0.12.20-46.el8_10 (AXSA:2026-2077:01)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2077:01 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

PT-2026-115390

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:i...

PT-2026-115502

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7 via the putFile function. This is due to insufficient file type validation in the putFile function, as sanitize file name does not...

Apache Doris 4.1.5 JDBC Catalog Arbitrary File Read

Apache Doris version 4.1.5 JDBC catalog handling permits an attacker-controlled MySQL server to request arbitrary local files from the Frontend host through the MySQL driver's LOCAL INFILE support. The proof of concept demonstrates the issue. !/usr/bin/env python Apache Doris 4.1.5 JDBC Catalog...