408959 matches found
PT-2026-82475
Name of the Vulnerable Software and Affected Versions CodeMeter Runtime affected versions not specified Description The cmu.exe utility creates a predictable temporary file in the C:CM-Stick directory when the --create-io flag is used with the --file parameter. The application fails to properly...
PT-2026-82621
Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4 Description Path traversal occurs in model-artifact APIs when pathsec is enabled. The issue arises from the use of raw file operations on caller-controlled paths, which allows bypassing pathsec enforcement. This...
PT-2026-82623
Name of the Vulnerable Software and Affected Versions UI-TARS-desktop mcp-http-server version 1.2.4 prior to commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168 Description The startServer.ts file in the mcp-http-server package defaults the listen address to :: when no host is provided. This causes t...
CVE-2026-38344
A NULL pointer dereference in the getminbuffersize function /libswscale/slice.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...
PT-2026-82763
An integer overflow in the hScale16To19 c function libswscale/output.c of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted image file...
PT-2026-82786
A path traversal vulnerability exists in the built-in preview/development web server of Lektor 3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensiti...
CVE-2026-38343
An integer overflow in the libavfilter/vfscale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service DoS via supplying a crafted video file...
PT-2026-82649
Name of the Vulnerable Software and Affected Versions cPanel & WHM versions prior to 11.110.0.141 cPanel & WHM versions prior to 11.134.0.53 cPanel & WHM versions prior to 11.136.0.37 cPanel & WHM versions prior to 11.138.0.2 WP Squared versions prior to 11.138.1.7 Description An eval injection a...
PT-2026-82784
The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them...
CVE-2026-37073
Veno File Manager Project 4.4.9 suffers from an incorrect access control vulnerability in the /vfm-admin/ajax/sendfiles.php endpoint. An unauthenticated attacker can send emails through the application's configured SMTP server by issuing a POST request with the required parameters and headers. Th...
Linux Distros Unpatched Vulnerability : CVE-2026-81726
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...
Linux Distros Unpatched Vulnerability : CVE-2026-77652
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/wpg-import.c, the WPG import renderer...
CVE-2026-37072
Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php...
CVE-2026-37068
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint...
CVE-2026-37068
Veno File Manager Project 4.4.9 is vulnerable to an arbitrary file write via the endpoint /vfm-admin/index.php?section=translations&action=update. An authenticated user with the super administrator role can overwrite any PHP file in the application using a specially crafted POST request, potentia...
CVE-2026-37071
Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming th...
PT-2026-82804
A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import session/export session of the file mcp sequential thinking/server.py of the component Import Session/Export Session. Such manipulation of the argument file path leads to path traversal...
CVE-2026-37067
CVE-2026-37067 is an incorrect access control flaw in the file /vfm-admin/admin-panel/view/save-cvs.php of Veno File Manager Project 4.4.9 . An unauthenticated attacker can send a specially crafted POST request to extract all application logs from a chosen date forward, resulting in a low confide...
PT-2026-82622
Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A filesystem containment bypass exists in the Downloader.download and Downloader.incr download methods. Attackers with write access to a shared downloader directory can create hardlinks pointing to fil...