EUVD-2026-62368

In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault...

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

Security update for open-iscsi

This update for open-iscsi fixes the following issues: CVE-2026-44943: remote file-write as root via discovery bsc1268353. CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

CVE-2026-72456

A flaw was found in AppArmor within the Linux kernel. When the getcurrentexepath function encounters a path resolution failure, it fails to properly release file and path references. This resource leak could be exploited by a local attacker, potentially leading to a Denial of Service DoS by...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-16617

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-11565

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...

CVE-2026-19417

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-19417 KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports...

CVE-2026-18051 W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

EUVD-2026-62277

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

CVE-2026-18051

The W3 Total Cache WordPress plugin before 2.10.5 fails to validate the page cache key request path, enabling unauthenticated attackers to perform path traversal and write or overwrite arbitrary files anywhere on the server, including .htaccess on Apache. CVSS 10.0 (Critical) reflects no auth, no...

EUVD-2026-62272

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

CVE-2026-16617

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

CVE-2026-16616 Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

EUVD-2026-62271

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16616

The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...

CVE-2026-16617 Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

EUVD-2026-62256

The Advanced File Manager WordPress plugin before 5.4.13 does not perform capability checks in several of its file management AJAX actions, allowing users with any role to which an administrator has granted file-manager access as low as Subscriber to read arbitrary files on the server — including...