GHSA-3JQQ-PW4J-PQCJ JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

Description A language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

GHSA-3325-V43H-43RV JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

CVE-2026-95588

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

CVE-2026-62071

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2024-58388

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

GitPython: GitPython: Arbitrary file read via TagReference.create()

A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the TagReference.create function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as --file=, to read...

CVE-2026-79899

Fortra BoKS Manager contains an insecure temporary file vulnerability in the bccgethostcert utility. The root cause is the creation of predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master with read access to files under BOKS_tmp may obtain CA secr...

EUVD-2026-90871

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-95588 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

CVE-2026-95588

The AcyMailing SMTP Newsletter WordPress plugin, affecting versions

CVE-2026-95588 WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

EUVD-2026-90855

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter = 11.0.5 versions...

EUVD-2026-90852

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071

The WordPress File Upload plugin (versions

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2024-58388 Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

EUVD-2024-55780

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...