PT-2026-114802

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them...

UBUNTU-CVE-2026-101337

When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...

UBUNTU-CVE-2026-101339

A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field a HIP Rendezvous server can overwrite the stack with up to 191 bytes of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD instance is...

CVE-2026-111324: Authorization Bypass Through User-Controlled Key

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log i...

CVE-2026-111346: Authorization Bypass Through User-Controlled Key

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...

CVE-2026-111368: Authorization Bypass Through User-Controlled Key

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE...

CVE-2026-55480: Improper Link Resolution Before File Access

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copymodel in scheduler/ipp.c creates a predictable TempDir/ .ppd path in an lp-group-writable directory and opens it as root without OEXCL or ONOFOLLOW. Exploitation requires an...

CVE-2026-79824: Path Traversal: '\dir\..\filename'

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

CVE-2026-96537: Missing Authorization

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them...

CVE-2026-102740: UNIX Symbolic Link (Symlink) Following

The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12, PropertiesBasedResumableProcessor stores resumable download state at the predictable shared path...

CVE-2026-103304: Missing Authorization

The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking notification emails, and overwrite the content of the email...

PT-2026-115290

ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify comments on bugs, stories, tasks, and...

PT-2026-115282

Name of the Vulnerable Software and Affected Versions rustdesk-api versions prior to 2.8 Description An authorization bypass allows unauthenticated attackers to overwrite existing peer records. By sending a target device ID to the 'POST /api/sysinfo' endpoint, attackers can modify the hostname,...

PT-2026-115074

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description The PropertiesBasedResumableProcessor stores resumable download state at a predictable shared path...

HPE NonStop Python path traversal vulnerability

HPE NonStop Python T0993L01^AAL and earlier versions contain a path traversal vulnerability. This vulnerability arises because the TAR archive filename contains a “..” sequence, leading to directory traversal. It may allow attackers to overwrite any file...

ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

RHEL 8 : lrzsz (RHSA-2026:83525)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

CVE-2026-104109

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

CVE-2026-104109

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

EUVD-2026-101660

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...