PT-2026-84646

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-84702

Name of the Vulnerable Software and Affected Versions Broken Link Checker versions prior to 2.4.15 Description An Editor Server Side Request Forgery SSRF exists in the plugin. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location,...

D-link DIR-823X Router Command Execution

The vulnerability of the sub424D20 function /goform/setipv6 of the D-link DIR-823X router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute...

D-Link DNS-327L DNS-340L Arbitrary Command Execution Unauthorized Access

The vulnerability in the cgi/diskmgr/vemgr.cgi script of the D-Link DNS-327L and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gain...

D-Link DNS-345 Network Storage Software Command Execution

The vulnerability in the cgi/backupmgr/iscsimgr.cgi script of the D-Link DNS-345 and DNS-340L network storage software is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely and gai...

D-Link DCS-932L Subroutine Arbitrary Command Execution

The vulnerability of the sub42EF14 function /bin/alphapd of the D-Link DCS-932L microprogrammed surveillance camera is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

Mesh module Code Execution

The vulnerability of the Mesh module in Microprogramming Software for TP-Link Deco XE75, XE5300, and WE10800 lies in the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and execute arbitrary code...

CVE-2026-76758: Improper Input Validation

Vulnerability in Drupal Link content parser. This issue affects Link content parser versions:...

CVE-2026-75528: Improper Neutralization of Input During Web Page Generation

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-84877

This module enables you to log the emails sent by Mailer Plus as content entities, so they can be reviewed at Reports Mail log. The module doesn't sufficiently redact the content of the emails it logs. Account related emails are stored with their one-time login links intact, so any user who can...

EUVD-2026-66381

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2026-84370

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.4, 3.3.5, and 4.1.0, the opt-in removeScripts plugin, named removeScriptElement in versions 2 and 3, incompletely filters executable links in...

GHSA-J8PM-GJ4C-RQ4X league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2024-14047

CVE-2024-14047 is a local Improper Link Resolution Before File Access vulnerability in the Winlogbeat Windows installer (Elastic). The installer placed runtime files in a directory writable by unprivileged users, allowing a low-privileged attacker with existing system access to pre-position malic...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Exploit for CVE-2026-82592

D-Link Router DIR-825M - Buffer Overflow in /boafrm/formDiskFo...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-19820

A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows ...