PT-2026-122284

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using HEADERSTRIP decompression...

CVE-2026-104109: Improper Link Resolution Before File Access

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

CVE-2026-106166: Authorization Bypass Through User-Controlled Key

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

CVE-2026-87968: Improper Access Control

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

PT-2026-122397

Security vulnerability affects the gst-plugins-good package. Integer overflow in avidemux element in gst avi demux invert function which allows a heap overwrite while parsing avi files...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130117)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130117 advisory. rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output...

PT-2026-114424

Name of the Vulnerable Software and Affected Versions curl versions prior to 8.23.0-1.1 Description When using the --remote-header-name -J option, the software fails to maintain anti-clobbering protection under specific conditions. This occurs if an intermediate 103 Early Hints response precedes...

PT-2026-113662

The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previously submitted form entry by referencing...

NSD -- multiple vulnerabilities

NLnet Labs reports: This security release has fixes for vulnerabilities which were all for cases with specially crafted and formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which NSD is secondary, would not be formatted like this. The zone file h...

PT-2026-122395

Security vulnerability affects the gst-plugins-good package. Integer overflow in matroskademux element in gst matroska demux add wvpk header function which allows a heap overwrite while parsing matroska files...

PT-2026-122360

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in qtdemux using zlib decompression...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130160 advisory. An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate...

PT-2026-122331

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using lzo decompression...

PT-2026-113685

The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capability check on the AJAX action that registers the store with its feed service and exposes it to unauthenticated users, so any visito...

PT-2026-113973

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

PT-2026-122350

Security vulnerability affects the gst-plugins-good package. DOS / potential heap overwrite in mkv demuxing using bzip decompression...

CVE-2026-110232

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110234

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

CVE-2026-110234 Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...

CVE-2026-110234 Elio through 1.13.0 Insecure Temporary File Creation in External Preview Command Capture

Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predictable capture paths. Attackers who know the victim's Elio process ID can plant a symlink so previewing media, fonts or archives...