CVE-2026-53581 ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-53581

OPNsense is a FreeBSD-based firewall and routing platform. A path traversal vulnerability in the NTP configuration module allows an attacker with access to NTP settings to manipulate the GPS or PPS serial port parameter , escaping the intended directory and forcing the system to write user-contro...

CVE-2026-53581 ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

Summary The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as version without sanitizing path separators or traversal components. The completed path reaches the compiler's emitFile, which creates the parent directory and write...

GHSA-2Q42-4Q24-7RGV OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

Summary The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as version without sanitizing path separators or traversal components. The completed path reaches the compiler's emitFile, which creates the parent directory and write...

GHSA-C7R6-VX3H-W5G2 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

EUVD-2026-69706

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path...

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...

CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

CVE-2026-86725 AVideo SocialMediaPublisher Missing Authorization via add.json.php

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoint that allows authenticated users to modify other users' OAuth token records. Attackers can supply arbitrary row IDs to overwrite another...

USN-8735-1 hsqldb1.8.0 vulnerability

It was discovered that HSQLDB incorrectly handled specially crafted database files. An attacker could possibly use this issue to overwrite arbitrary files...

USN-8735-1: HSQLDB vulnerability

It was discovered that HSQLDB incorrectly handled specially crafted database files. An attacker could possibly use this issue to overwrite arbitrary files...

CVE-2026-3174

The Event Tickets and Registration plugin for WordPress is affected by a missing capability check on the Stripe OAuth return endpoint in all versions up to and including 5.27.4 . Discovered by researcher h0xilo , the flaw allows an unauthenticated attacker to overwrite the site's Stripe merchant ...

CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

CVE-2026-3174 Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update

The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it possible for unauthenticated attackers to overwrite the site...

DNN - Unrestricted Arbitrary File Upload

DNN formerly DotNetNuke \u003C 10.1.1 contains an unrestricted file upload vulnerability caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting existing files, letting unauthenticated attackers deface websites and inject XSS payloads, exploit requires no...

CVE-2026-78254

A flaw was found in Apache Ant. The ftp and scp tasks, used for downloading files, are vulnerable to a path traversal issue. A malicious remote server can exploit this by providing specially crafted relative paths, allowing it to write files outside the intended download directory. This could lea...

EUVD-2026-72559

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

EulerOS 2.0 SP12 : perl-GD (EulerOS-SA-2026-3367)

"According to the versions of the perl-GD package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open of filename arguments in makefilehandle...