EUVD-2026-92766

Ghost: Path Traversal via Locale Setting...

Ghost: Path Traversal via Locale Setting

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's directory, potentially exposing server configuration secrets. Vulnerable versions This vulnerability is present in Ghost from v1.20.0 up to...

GHSA-JJ74-HC2Q-XRVM Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...

Ghost: Remote Code Execution via Theme Translation Files

Impact A vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a crafted theme. Vulnerable versions This vulnerability is present in Ghost from v6.10.3 up to v6.64.0. Patches v6.64.0 contains a fix for this issu...

EUVD-2026-92767

Ghost: Remote Code Execution via Theme Translation Files...

NPM: Ghost: Remote Code Execution via Theme Translation Files

NPM: Ghost: Remote Code Execution via Theme Translation Files vulnerability discovered by ? in WordPress Npm ghost versions = 6.10.3, 6.64.0...

CVE-2026-42532

A flaw was found in VisiData. A path traversal vulnerability in the EmailSheet attachment extraction feature allows an attacker to write arbitrary files by convincing a user to process a specially crafted email .eml file. This flaw enables an attacker to create or overwrite critical files outside...

CVE-2026-106442

A flaw was found in hydra-core. The instantiate mechanism does not properly validate callable targets against its blocklist, allowing execution wrappers and deferred calls to bypass authorization checks. An attacker who convinces an application or user to process untrusted configuration files can...

WordPress Super Forms plugin <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter vulnerability

Unauthenticated Arbitrary Directory Deletion via 'data...filessubdir' Parameter vulnerability discovered by d.v4ns3c in WordPress Plugin Super Forms versions = 6.3.316...

CVE-2026-76488

A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...

EUVD-2026-92775

Ghost: Path Traversal Vulnerability in Ghost ImageSize Service...

EUVD-2026-94456

Cisco Jabber for Android com.cisco.im before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized displ...

CVE-2026-76454 Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an unauthenticated, remote attacker to write arbitrary files to the system or cause a DoS condition on an affected application. This...

POC-CVE-2025-24813

CVE-2025-24813 – Demonstration Environment PoC This repository contains a simple application built to observe the behavior of CVE-2025-24813, a recent vulnerability in Apache Tomcat related to the use of the DefaultServlet with writing enabled readonly=false, allowing unsafe write operations via...

EUVD-2026-94329

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 enthält bedeutende Modernisierungsänderungen: Python 3.9+ erforderlich - Unterstützung für Python 3.6, 3.7 und 3.8 wurde eingestellt attrs-Bibliothek entfernt - Datenklassen verwenden jetzt das in Python integrierte dataclasses-Modul Wenn Ihr...

CVE-2026-92533

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

CVE-2017-0199

Toolkit di exploit CVE-2017-0199 Il toolkit di exploit CVE-2017-0199 è un pratico script Python che fornisce a pentester e ricercatori di sicurezza un modo rapido ed efficace per testare RCE di Microsoft Office. Può generare un file RTF/PPSX malevolo e consegnare una payload metasploit /...

CVE-2026-92533

A path traversal vulnerability exists in the BugTracker.NET file download component. The flaw stems from improper validation of user-supplied paths in the parameter used to specify file names. An authenticated remote attacker could provide a manipulated path to access files outside the intended d...

EUVD-2026-94285

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...