CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...

CVE-2026-68560

Wekan (open-source kanban built with Meteor) is vulnerable to shell injection in models/fileValidation.js prior to version 9.75 . When an external antivirus scanner is configured, the uploaded file path is interpolated into the administrator-defined externalCommandLine at its {file} placeholder a...

CVE-2026-32475

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...

EUVD-2026-62595

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tin Pham aka TF1T in WordPress Plugin Elementor Pro versions = 4.2.1...

CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-75949 Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

EUVD-2026-62489

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-75949

J-BusinessDirectory (Joomla extension by cmsjunkie.com) versions below 6.2.3 accept a client-controlled _path_type parameter without path-containment enforcement or a strong extension check, enabling arbitrary file upload/deletion and CSRF via missing tokens. Exploitation details are not provided...

CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-75114

creationtimestamp| type| source ---|---|--- 2026-08-19 14:04:01+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2kahc2s 2026-08-19 14:04:02+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2lbns2s...

EUVD-2026-62434

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803

The Joomla Zoo extension (versions before 4.1.64) accepts arbitrary files via its image element when the client-supplied Content-Type falls within the image MIME group, enabling unauthenticated remote code execution. No exploitation details are provided; update to Zoo 4.1.64 or later. CVSS 4.0 sc...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

CVE-2026-74803 Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group...

PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw exists in the Form widget of Elementor Pro, potentially affecting over 6 million active installations. The issue occurs when a public form contains at least one...

PT-2026-78448

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root path type could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token...