PT-2026-84409

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write flaw exists in the API of HPE Networking Fabric Composer. This issue allows an authenticated user with low privilege operator permissions to...

PT-2026-84109

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload template kit function. This is due to incorrect...

PT-2026-84423

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write issue exists in the API of the software, which could allow an authenticated administrative user to escalate privileges. Successful exploitation...

PT-2026-84208

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description A protection mechanism failure allows an authenticated user with limited privileges to write attacker-controlled content to arbitrary filesystem paths. Recommendations At the moment,...

Codeium Windsurf Path Traversal Vulnerability (CVE-2025-62353)

The version of Windsurf installed on the remote host is affected by a path traversal vulnerability: - A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outside of current projects on an end user's system. The...

Hugging Face Transformers library writes remote code to disk prior to consent check

Overview A vulnerability in the Hugging Face Transformers library versions 4.57.0 to 5.16.1 allows remote, attacker‑controlled Python files to be written to the local disk without user authorization. The library performs a remote module fetch and local cache write before evaluating the...

Important: gegl04 security update

GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer overflow in HDR file parsing CVE-2026-18300 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

PT-2026-84521

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0 through 4.1.10 Vitest versions 5.0.0-rc.0 through 5.0.0-rc.1 Description The mockerPlugin and interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on...

The vulnerability of the application software interface of the Natural Language Processing library package NLTK allows a hacker to bypass existing security mechanisms and gain access to read and write arbitrary files.

The vulnerability of the application programming interface of the Natural Language Processing library NLTK is related to improper external management of file names or file paths. Exploiting this vulnerability can allow an attacker to bypass existing security mechanisms and gain read-write access ...

Alibaba Cloud Linux 3 : 0262: abrt (ALINUX3-SA-2026:0262)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0262 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-54228: A time-of-check time-of-us...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

PT-2026-84524

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.2 Thunderbird versions prior to 154 Description Malicious calendar invitations can utilize file URI attachments to execute local or network-hosted executables on Windows systems, bypassing standard executable...

PT-2026-84522

Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69 Description The MaatwebsiteExcelFilesDisk::copy function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store, $export-store, or storeExcel, against the process working...

PT-2026-84478

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated Path Traversal vulnerability exists in the web-based management interface. Path Traversal is a flaw that allows an attacker to access files and directories that are stored...

PT-2026-84108

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

PT-2026-84299

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write file and write files batch tools, allowing attackers to write files outside the intended PROJECT ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrit...

PT-2026-84424

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Insecure file operations within the API allow an authenticated remote attacker to achieve remote code execution. This flaw enables the execution of arbitrary commands a...

PT-2026-84219

Name of the Vulnerable Software and Affected Versions Gravity Forms versions prior to 3.0.3 Description An arbitrary file upload issue exists affecting over 1 million WordPress installations. The flaw originates from insufficient validation of the multi-file upload chunk state within the...

EUVD-2026-69195

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...

PT-2026-84244

Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the cs broker component...