275006 matches found
CVE-2026-53803
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...
CVE-2026-53802
The vulnerability CVE-2026-53802 affects rsync prior to 3.5.0. An arbitrary file read is possible by abusing symlink following in input configuration handling (including --files-from, --password-file, and filter merge files), allowing an attacker to read files accessible to the rsync daemon proce...
CVE-2026-53802
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...
CVE-2026-73509 OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...
CVE-2026-73353
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce 4.22.10 versions...
CVE-2026-73401
Unauthenticated Broken Access Control in InstaWP Connect = 0.1.3.7 versions...
CVE-2026-66691
Unauthenticated Broken Access Control in Nokri = 1.6.6 versions...
CVE-2026-66693
Subscriber Broken Access Control in Motors = 1.4.113 versions...
CVE-2026-66661
Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...
CVE-2026-66469
Unauthenticated Broken Access Control in Arvow AI SEO Writer = 1.5.3 versions...
CVE-2026-66464
Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...
CVE-2026-66455
Subscriber Broken Access Control in ReactPress = 3.4.0 versions...
CVE-2026-66454
Unauthenticated Broken Access Control in WP Social Avatar = 1.5 versions...
CVE-2026-66441
Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...
CVE-2026-66446
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
CVE-2026-65582
Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...
CVE-2026-66424
Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...
CVE-2026-61979
Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...