CVE-2026-65827 Docmost: Unbounded ZIP decompression (zip-bomb) in page import allows denial of service

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

CVE-2026-63630 BentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf sends an...

CVE-2026-63630

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf sends an...

CVE-2026-96515

The Netlink ICT HG323RW router is susceptible to a command injection vulnerability due to insufficient authorization and input validation controls within the diagnostic script import functionality . An authenticated attacker can exploit this by uploading and executing a specially crafted script v...

WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Intrudify in WordPress Plugin Import and export users and customers versions = 2.5.2...

Astra Linux – Vulnerability in Chromium

The privilege escalation in Import in Google Chrome prior to version 151.0.7922.173 allowed a remote attacker to leverage social engineering to potentially execute arbitrary code outside of the sandbox, through a crafted file. Chromium security severity: High...

WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Template Kit – Import versions = 1.0.16...

Exploit for CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Pyt...

CVE-2026-88845

The MasterStudy LMS WordPress Plugin versions before 3.7.50 is vulnerable to an unauthorized action due to a lack of capability or nonce checks on an administrative maintenance action. This flaw allows any authenticated user , such as a subscriber, to trigger the action and create published conte...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

EUVD-2026-85704

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

PT-2026-97789

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

REDCap 17.4.3 Survey Passthru Data Import Checker

REDCap versions 13.3.0 through 16.0.48, 17.0.0 through 17.3.9, and 17.4.0 through 17.4.3 contain an unauthenticated remote code execution vulnerability in survey passthrough routing and Data Import processing. This tool fingerprints instances and probes public-survey passthrough routes...

PT-2026-98244

Name of the Vulnerable Software and Affected Versions Docmost versions 0.21.0 through 0.94.0 Description An issue exists in the page-import feature where the ZIP extraction routine fails to limit the total uncompressed size, per-entry size, or entry count of uploaded archives. An authenticated...

CVE-2026-96515: Missing Authorization

This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a specially crafted script through the w...

CVE-2026-65827: Uncontrolled Resource Consumption

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or...

FreeBSD : podman -- vulnerabilities (050e54b4-b81e-11f1-b540-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 050e54b4-b81e-11f1-b540-589cfc10a551 advisory. The Podman developers report: This release addresses CVE-2025-11395, where importing images...

CVE-2026-86583

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-86583 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-86583 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...