CVE-2026-105221: Improper Certificate Validation

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

CVE-2026-105123

The W (vincent-peugnet/wcms) content management system, version through 3.18.0 , is vulnerable to Remote Code Execution (RCE) and Arbitrary File Write via the Media Upload API. The root cause is an unvalidated path in the POST /api/v0/media/upload/[*:path] endpoint. Authenticated editors can expl...

CVE-2026-105123 W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API

W vincent-peugnet/wcms through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/:path. Attackers can upload .php files executed by the web server, use encoded ../ sequences...

Security Bulletin: IBM Maximo Application Suite is vulnerable to a sensitive information disclosure

Summary IBM Maximo Application Suite login service could allow an unauthenticated user to access sensitive system information. This bulletin contains information regarding the vulnerabilities and their fix. Vulnerability Details CVEID:CVE-2026-105052 DESCRIPTION: Maximo Application Suite could...

Exploit for CVE-2026-103648

CVE-2026-103648 — Path Traversal in image-downloader !CV...

CVE-2026-104983

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

CVE-2026-104983

A path traversal vulnerability exists in Linux Mint Xreader up to version 4.6.9 . The flaw resides in the PDF Attachment Saving Handler component, specifically within the g_file_get_child function of the shell/ev-window.c file. By manipulating the attachment argument, an attacker may perform a re...

CVE-2026-104983 Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

CVE-2026-104983 Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

EUVD-2026-92012

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

CVE-2026-104983 Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal

A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function gfilegetchild of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The...

Security Bulletin: Due to the use of Apache Ant, IBM Sterling Control Center is vulnerable to Relative Path Traversal (CVE-2026-78254)

Summary Apache Ant is used by IBM Sterling Control Center as part of dependency in ant-1.10.11.jar Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to...

CVE-2026-71889 PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate

In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkNameConstraints walked the path with a loo...

CVE-2026-104982

A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setupdocumentcontentlist/gstrdupprintf of the file backend/epub/epub-document.c of the component EPUB File Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely...