Security Bulletin: Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

Summary A path traversal vulnerability existed in the File component's tar archive extraction functionality. An authenticated user could upload a specially crafted tar archive containing symbolic links to read arbitrary files accessible to the application process. The vulnerability allowed an...

CVE-2022-50973

creationtimestamp| type| source ---|---|--- 2026-07-02 19:14:02+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mpoqi7o6gp2f 2026-07-02 19:45:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mposbcvlax2n 2026-07-02 20:30:04+00:00| seen|...

CVE-2026-56004

creationtimestamp| type| source ---|---|--- 2026-07-02 17:02:25+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj4u4vxb2v 2026-07-02 19:11:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpoqdaf76u2v 2026-07-03 07:19:31+00:00| seen|...

CVE-2026-56842

creationtimestamp| type| source ---|---|--- 2026-07-02 17:02:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpoj4mzudb2v 2026-07-02 18:46:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpooxqxrlq2z 2026-07-03 07:26:23+00:00| seen|...

CVE-2026-57345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-57345

The CVE-2026-57345 entry concerns WordPress Internal Links Manager plugin versions <= 3.0.3 and describes an Unauthenticated Cross Site Scripting (XSS) vulnerability. The connected Patchstack reference confirms an XSS flaw in WordPress Internal Links Manager

CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Internal Links Manager = 3.0.3 versions...

CVE-2026-13251

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information...

CVE-2026-12472

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-12472 Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-0000-0002

creationtimestamp| type| source ---|---|--- 2026-07-02 07:56:25+00:00| seen| https://gist.github.com/tu-trinh-scale/265fe56213773656e2eb7ef2f25c2394 2026-07-02 07:56:27+00:00| seen| https://gist.github.com/tu-trinh-scale/14715efedc4ce81a9789a4cbdcf13286 2026-07-03 09:17:40+00:00| seen|...

CVE-2026-51946

creationtimestamp| type| source ---|---|--- 2026-07-02 07:17:38+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnih6gcem2k 2026-07-02 07:24:19+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpnit5xhki22 2026-07-03 12:06:17+00:00| seen|...

OPENSUSE-SU-2026:21208-1 Security update for cockpit

This update for cockpit fixes the following issue - CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI bsc1265040...

CVE-2026-14082

creationtimestamp| type| source ---|---|--- 2026-07-02 06:23:17+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpnffzighe2f 2026-07-02 06:23:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnffzq3dt2q 2026-07-02 07:51:49+00:00| seen|...

CVE-2026-14076

creationtimestamp| type| source ---|---|--- 2026-07-02 01:45:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmvunbqlz22 2026-07-02 01:45:08+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmvun6jo72s 2026-07-02 07:51:36+00:00| seen|...

CVE-2026-14016

creationtimestamp| type| source ---|---|--- 2026-07-02 00:20:30+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmr5d64x62t 2026-07-02 00:20:32+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmr5eg4xv2r 2026-07-02 07:49:26+00:00| seen|...

CVE-2026-14036

creationtimestamp| type| source ---|---|--- 2026-07-02 00:17:59+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mpmqysi7pz2o 2026-07-02 00:18:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmqyu34dn2q 2026-07-02 07:50:09+00:00| seen|...

CVE-2026-14419

creationtimestamp| type| source ---|---|--- 2026-07-02 00:00:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmpyz4dpi2s 2026-07-02 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116847792934953006 2026-07-02 01:30:27+00:00| seen|...

The vulnerability of the check_access_permission() function in the pgAdmin 4 database management tool allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the checkaccesspermission function in the pgAdmin 4 database management tool is related to deficiencies in the mechanism for handling symbolic links. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and accessibility of the protected...