110558 matches found
EUVD-2026-47915
Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...
CVE-2026-64799
The Joomla Extension by regularlabs.com is vulnerable to Server-Side Request Forgery (SSRF) within the Articles Anywhere and Users Anywhere extensions. The root cause is that content-controlled image URLs can request private or reserved network services, follow unsafe redirects, and save response...
CVE-2026-16078
The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the...
CVE-2026-16078
CVE-2026-16078 affects the WCPOS
policycoreutils: Policycoreutils: Arbitrary file deletion via TOCTOU race condition in seunshare
A flaw was found in policycoreutils through 3.10 in seunshare. A TOCTOU race lets a local user running in an unconfined SELinux domain delete arbitrary root-owned files. Removing critical system files can cause denial of service; integrity impact is limited to unauthorized deletion...
Helm Files.Lines Denial of Service via Empty Chart Files
...
DEBIAN-CVE-2026-59676
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
CVE-2026-59676
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
CVE-2026-59676 Local File Deletion Attack Vector in rm_rf() in seunshare
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
EUVD-2026-47888
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
CVE-2026-59676
This CVE concerns a TOCTOU race in the seunshare utility of policycoreutils (up to version 3.10) that lets a user in the unconfined SELinux domain delete arbitrary root-owned files. Affected component: seunshare within policycoreutils; root cause: TOCTOU race enabling local file deletion via rm_r...
CVE-2026-59676
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
CVE-2026-59676 Local File Deletion Attack Vector in rm_rf() in seunshare
A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...
@cognidesk/integration-ticketing-servicenow (>=0.0.4, <=0.0.6), @darthcav/ts-http-server (0.9.1) +16 more potentially affected by CVE-2026-7120 via @fastify/static (>=10.1.0, <=10.1.1)
@fastify/static NPM version =10.1.0, =0.0.4, =0.7.1, =3.1.17, =1.3.8, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =4.11.0, =5.1.0, =6.5.2, =4.6.0, =4.8.4 and more Source cves: CVE-2026-7120 Source advisory: SNYK:JS-FASTIFYSTATIC-18233800...
CVE-2026-6390
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vulnerability may allow an attacker to...
Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
PT-2026-63969
Name of the Vulnerable Software and Affected Versions JetBrains IntelliJ IDEA versions prior to 2026.2 Description Arbitrary code injection is possible through the use of UI Designer form files. Recommendations Update JetBrains IntelliJ IDEA to version 2026.2...
PT-2026-64129
Summary The MentionsParser in src/praisonai-agents/praisonaiagents/tools/mentions.py processes @file: mentions in agent prompts by reading arbitrary files from the filesystem. When a file path is not found relative to the workspace, the parser falls back to using the path as an absolute path...
PT-2026-63611
ReReplacer XML include paths could read files outside the site directory...
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers across US Critical Infrastructure
The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology OT devices, including programmable logic controllers PLCs. These actions disrupted PLCs across several U.S. critical infrastructure sectors through...