kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources

A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation TLBI operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local...

CVE-2026-71313

A flaw was found in rclone, a command-line program for syncing files. The local backend's filename encoder, when configured in certain ways, can improperly decode remote filenames. This allows an attacker to craft a source object that, when processed, can create or overwrite files outside the...

CVE-2026-54218

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-54218

CVE-2026-54218 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue stems from use of a hard-coded cryptographic key and password storage across locally created users in David, where passwords are stored in various files using only obfuscation. If an attacker can access the server’s file s...

CVE-2026-54200 TeamDavid: Local File Inclusion via the form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-54200

The CVE-2026-54200 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. It describes a local file inclusion vulnerability in the “send email, fax, SMS, etc.” function accessible via the form field scjob where an the command like @@attach can attach files to a message, enabling an authenticate...

EUVD-2026-54432

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-9169

CVE-2026-9169 describes a DLL search order hijacking issue in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows. An attacker with local access can place a malicious DLL in a user-controlled directory that appears in the PATH the SDK traverses to resolve a dependency, resulting in arbitrary code ex...

CVE-2026-18938

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...

CVE-2026-19079 Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

A TOCTOU Time-of-Check-Time-of-Use race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker...

CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

EUVD-2026-54391

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16263 WP Maps < 4.9.7 - Subscriber+ Local File Inclusion

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

CVE-2026-16263

CVE-2026-16263: WP Maps WordPress plugin prior to 4.9.7 is vulnerable due to a missing capability check in an AJAX action and insufficient validation of a user-controlled path used in a local file inclusion. This allows users with a Subscriber account to include and execute arbitrary existing loc...

CVE-2026-19195

A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed ...