EUVD-2026-87508

OpenClaw npm package 'openclaw' versions = 2026.5.28 and 2026.8.1 mishandle archive listings in the tar.bz2 skill installer: bounded command-output suffixes were treated as complete listings of the archive. A crafted .tar.bz2/.tbz2 skill archive can push prohibited entries out of both retained...

PT-2026-99179

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.28 through 2026.8.0 Description The tar.bz2 skill installer mishandles archive listings by treating bounded command-output suffixes as complete listings. A specially crafted .tar.bz2 or .tbz2 skill archive can push...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

EUVD-2026-86599

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-86938

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3...

CVE-2026-91800

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-91800 Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

EUVD-2026-85122

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-91800

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS . The vulnerability is caused by insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this flaw to execute arbitrary commands...

CVE-2026-91800 Foxit PDF Editor installer local privilege escalation

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

PT-2026-97219

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor for macOS affected versions not specified Description An issue in the installer allows a local attacker to gain root privileges. This occurs because the installer does not sufficiently validate a user-modifiable configuration...

PT-2026-97425

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3...

CVE-2026-91800: Incorrect Permission Assignment for Critical Resource

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-95667

MISP installer scripts (for Debian 12 , Debian 13 , Ubuntu 24.04 , and RHEL 9.4 ) created a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe using the system default umask, resulting in world-readable permissions (0644) . The log captured sensitive c...

CVE-2026-95667: Incorrect Permission Assignment for Critical Resource

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

PT-2026-96725

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp install.log and a named pipe FIFO at /var/log/misp install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-55567 BleachBit: Exploit File Delete to Escalate Privilege

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a target's parent directory before deletion. A local unprivileged user can replace that directory with a Windows junction and use a native symlink to redirect...

CVE-2026-15463: Improper Neutralization of Input During Web Page Generation

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

PT-2026-95779

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where...