SUSE CVE-2026-64013

In the Linux kernel, the following vulnerability has been resolved: ACPI: button: Fix ACPI GPE handler leak during removal Commit a7e23ec17fee "ACPI: button: Install notifier for system events as well" changed the ACPI notify handler type for ACPI buttons to ACPIALLNOTIFY, but it forgot to update...

CVE-2026-63966

A flaw was found in the Linux kernel's adis16550 Industrial Input/Output IIO Inertial Measurement Unit IMU driver. The adis16550triggerhandler function fails to fully initialize a stack-allocated data array. This oversight allows uninitialized stack memory to be exposed to userspace, leading to...

EUVD-2026-46157

The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...

CVE-2026-16329

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photocenter/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be...

CVE-2026-16331

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/saveajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed public...

EUVD-2026-46138

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/saveajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed public...

CVE-2026-16329 D-Link DNS-320 uploadify.php unrestricted upload

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photocenter/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be...

EUVD-2026-46136

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photocenter/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be...

CVE-2026-16329

The CVE-2026-16329 entry affects D-Link DNS-320 firmware 1.0.2. A vulnerable function in /photo_center/php/uploadify.php can be triggered by manipulating the Malicious Handler argument to allow unrestricted file upload. Exploitation is described as remote, with a publicly available exploit. No pa...

CVE-2026-16329

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photocenter/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be...

PT-2026-62421

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final Description A security control bypass exists during the origin evaluation process. The CorsHandler includes a shortCircuit configuration intended ...

The vulnerability of the upload component in the /photo_center/php/uploadify.php file of the D-Link DNS-320 network storage software allows a hacker to cause a service failure.

The vulnerability of the /photocenter/php/uploadify.php component in the D-Link DNS-320 network storage software is related to errors in access control when processing the “Malicious Handler” parameter. Exploiting this vulnerability allows an attacker to cause service failures...

GHSA-R557-WFFQ-WVRC @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ slash-backslash were not recognized as internal paths, so the handler would echo the raw path back...

Open Redirect

Overview @astrojs/internal-helpers is an Internal helpers used by core Astro packages. Affected versions of this package are vulnerable to Open Redirect via the static file handler when the trailingSlash: 'always' configuration is enabled. An attacker can redirect users to unintended external sit...

CVE-2026-64612

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the CUPS image filter process to abort when processing a malformed PNG file. An unauthenticated attacker could exploit this by submitti...

SUSE-SU-2026:3138-1 Security update for 389-ds

This update for 389-ds fixes the following issues - Update to version 2.7.0git212.9b0755edb. - CVE-2026-11610: heap buffer overflow in sasliorecv via padded SASL UNBIND bsc1270695. - CVE-2026-11611: content synchronization persistent search plugin can allow unbounded memory growth bsc1267975. -...

CVE-2026-54910

FileBrowser Quantum is vulnerable to a path traversal flaw in the subtitlesHandler endpoint (GET /api/media/subtitles) prior to v1.4.3-beta. The vulnerability arises from two user-controlled parameters, path and name, used in filesystem operations without sanitization. The path parameter is passe...

CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...