AZL-104994 CVE-2026-55556 affecting package rsyslog 8.2308.0-7

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

CVE-2026-62278

LubeLogger is a self-hosted, open-source web-based vehicle maintenance and fuel mileage tracker. In versions prior to 1.6.8 , authenticated non-administrative users could exploit a path traversal in HandleTranslationFileUpload by crafting a malicious file name. The underlying cause is in Helper/F...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

EUVD-2026-83201

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-61548

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSDPARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal32 1024 stack buffer and calls parsePARAMVALUE without supplying the...

CVE-2026-61548

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSDPARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal32 1024 stack buffer and calls parsePARAMVALUE without supplying the...

WordPress Filter Gallery plugin 1.1.2-1.1.4 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion vulnerability

Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion vulnerability discovered by Seongwon Lee in WordPress Plugin Filter Gallery versions 1.1.2-1.1.4...

CVE-2024-30804

ASUS 드라이버 LPE PoC 물리 메모리 남용 이것은 AsInsHelp64.sys 드라이버를 악용하는 로컬 권한 상승LPE PoC입니다. 합법적이고 서명된 ASUS 드라이버를 남용하여 물리 메모리를 매핑하고 커널 토큰을 덮어쓰며, 궁극적으로 NT AUTHORITY\SYSTEM 권한을 획득합니다. 🎯 취약점 정보 대상 : AsInsHelp64.sys ASUS 팬 Xpert v.10013 미만 관련 기법 : 임의 물리 메모리 읽기/쓰기 근본 원인 : 드라이버는 모든 사용자가 물리 메모리를 가상 주소 공간에 매핑할 수 있는...

CVE-2026-88017

A flaw was found in rclone, a command-line program for syncing files to cloud storage providers. The FTP authentication proxy driver improperly handles user credentials across sessions. If two users share the same username but are linked to different storage backends, a later login can overwrite...

grafana: Grafana: Privilege escalation via dashboard overwrite

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard...

EUVD-2026-82726

The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-89138

The Filter Gallery plugin for WordPress is affected by an authorization bypass in all versions up to and including 1.1.4 . The root cause is a missing authorization check in the ufg_save_gallery AJAX action, specifically via the image_id parameter. This allows authenticated attackers with subscri...

CVE-2026-90978

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-84904

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...

EUVD-2026-82682

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...

CVE-2026-90978

The Filter Gallery WordPress plugin (versions before 1.1.5 ) is vulnerable to improper access control due to a fail-open nonce check . Several AJAX handlers fail to verify nonces when the field is omitted and do not perform capability checks. This allows low-privileged users (such as subscribers)...

CVE-2026-90978 Filter Gallery < 1.1.5 - Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check

The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted, and applies no capability check, allowing low-privileged users to overwrite the content of arbitrary posts and delete the Filter Gallery WordPress plugin...