411840 matches found
CVE-2026-79622
A path traversal vulnerability was identified in dekdee/adobe-xd-mcp version 1.0.0 , specifically in the file src/parsers/xd-parser.ts within the file-access-from-request Endpoint component. A remote attacker can manipulate the outputFile/outputDir argument to traverse the file system, leading to...
CVE-2026-79670
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...
RLSA-2026:59133 Important: gstreamer1-plugins-good security update
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license. Security Fixes: gstreamer: GStreamer: Remote Code Execution via MRF fil...
gstreamer1-plugins-good security update
An update is available for gstreamer1-plugins-good. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GStreamer is a streaming media framework based on graphs of...
CVE-2026-79670
Ech0 before 4.4.3 contains a stored cross-site scripting (XSS) vulnerability in its file upload endpoint . The root cause is that the endpoint validates the Content-Type header using only client-supplied values without performing server-side inspection of the uploaded file. An attacker with admin...
EUVD-2026-65444
Ech0 before 4.4.3 contains a stored cross-site scripting vulnerability in the file upload endpoint that validates Content-Type using only client-supplied headers without server-side inspection. Attackers with admin privileges can upload SVG or HTML files containing JavaScript that executes in the...
CVE-2026-75038
CVE-2026-75038 is a local denial-of-service vulnerability in LACT (ilya-zlobintsev/LACT), affecting versions through 0.10.0 . The root cause is a predictable temporary file created in /tmp , which an attacker can exploit via a UNIX symbolic link (symlink) following attack. The CVSS 3.1 score is 6...
CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT
UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...
CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT
UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...
CVE-2026-56136
A flaw was found in NTFS-3G. An out-of-bounds read vulnerability exists that allows a remote attacker to read potentially confidential information within an ntfs-3g process. This can be triggered by crafting a malicious NTFS image and creating a file with a specially crafted name. Mitigation To...
CVE-2026-78562
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-78566
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2026-77139
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...
CVE-2026-77139 Path Traversal in extension "Mask" (mask)
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...
CVE-2026-77139
CVE-2026-77139 is a path traversal vulnerability in the Mask (mask) extension for TYPO3 . The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask m...
EUVD-2026-65337
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files...
EUVD-2026-65326
The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to...
CVE-2026-78566
CVE-2026-78566 covers a Local File Inclusion (LFI) vulnerability in the Shuffle theme for WordPress , affecting all versions up to and including 1.8 . Unauthenticated attackers can include and execute arbitrary files on the server, enabling execution of any PHP code within those files. This can b...
