411192 matches found
EUVD-2026-64849
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-76843 Flair 0.15.0 and 0.15.1 Deserialization of Untrusted Data via ClusteringModel.load
The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loadsjoblib.loadstrmodelfile and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that...
CVE-2026-76840
RustDesk (through 1.4.9 ) contains a heap buffer overflow in its Windows CLIPRDR clipboard redirection module (libs/clipboard/src/windows/wf_cliprdr.c). The peer-supplied cbRequested length from a CLIPRDR FileContentsResponse is copied via CopyMemory into the caller's fixed-size buffer without be...
python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory
A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...
CVE-2026-74592
A flaw was found in the Linux kernel's Integrity Measurement Architecture IMA. When a file is truncated, the system's integrity policy hooks are not properly instantiated, preventing the action cache flags from being reset. This oversight means that after truncation, the file is not re-collected,...
CVE-2026-66671
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
CVE-2026-66670
Unauthenticated Local File Inclusion in Måne = 1.7 versions...
CVE-2026-66587
Unauthenticated Local File Inclusion in WP Cafe Pro 3.0.15 versions...
CVE-2026-32477
Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons = 2.2.0 versions...
CVE-2026-28152
Unauthenticated Local File Inclusion in Tonda Core 2.6 versions...
CVE-2026-28171
Unauthenticated Arbitrary File Deletion in WooCommerce File Approval = 10.7 versions...
CVE-2026-28151
Unauthenticated Local File Inclusion in Tonda 2.6 versions...
CVE-2026-28167
Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...
CVE-2025-63080
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...
python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory
A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...
EUVD-2026-64810
Unauthenticated Local File Inclusion in Måne = 1.7 versions...
CVE-2026-66670 WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Måne = 1.7 versions...
CVE-2026-66670
This is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress Måne theme (versions
CVE-2026-66587
WP Cafe Pro is a WordPress plugin affected by an unauthenticated Local File Inclusion (LFI) vulnerability in versions prior to 3.0.15 . Discovered by Ananda Dhakal via Patchstack, the flaw requires no authentication or user interaction and is scored CVSS 9.8 (Critical) with full confidentiality, ...