PT-2026-78533

Name of the Vulnerable Software and Affected Versions Elementor Pro versions prior to 4.2.2 Description An unrestricted file upload flaw exists in the Form widget of Elementor Pro, potentially affecting over 6 million active installations. The issue occurs when a public form contains at least one...

PT-2026-78366

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...

VulnCheck KEV: CVE-2026-32475

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-53453

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-68924

creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:08+00:00| published-proof-of-concept| https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-x768-8642-mmq9...

WordPress ProSolution WP Client plugin <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability

Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override vulnerability discovered by Nir Yehoshua - cipher security labs in WordPress Plugin ProSolution WP Client versions = 2.0.10...

CVE-2026-73373

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73373

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

EUVD-2026-61026

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-73996

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-66627

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5...

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

CVE-2026-50138 goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

CVE-2026-28192

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

EUVD-2026-60810

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-73996

The Masteriyo LMS WordPress plugin (≤2.3.2) allows unauthenticated arbitrary file uploads, enabling remote code execution on affected sites. Patchstack rates it Critical (CVSS 9.8). No patch version or exploitation evidence is provided in the documents.