PT-2026-104523

Name of the Vulnerable Software and Affected Versions Unlimited Elements for Elementor WordPress plugin versions prior to 2.0.21 Description Insufficient sanitization of file paths within uploaded archives allows authenticated users with access to the asset-management feature to write arbitrary...

PT-2026-104544

Name of the Vulnerable Software and Affected Versions VikAppointments Services Booking Calendar versions prior to 1.2.22 Description Insufficient file path validation in the extract function allows unauthenticated attackers to delete arbitrary files on the server. This issue can lead to remote co...

VulnCheck KEV: CVE-2026-97359

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template...

Fedora 43 : unbound (2026-41f949afc4)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-41f949afc4 advisory. Update to 1.26.1 rhbz2535076 Security fix list from upstream: - Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code Execution when...

Linux Distros Unpatched Vulnerability : CVE-2026-103628

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-103622

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-103626

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engineering to potential...

CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution 2.x before 2.14.12, 3.x before 3.9.12, 4.0.x before 4.0.11, 4.1.x before 4.1.11, 4.2.x before 4.2.8, 4.3.x before 4.3.5, and 4.4.x before 4.4.3, as used by Amazon SageMaker Unified Studio, might...

CVE-2026-104019

An OS command injection vulnerability exists in the Studio Space startup validation script of Amazon SageMaker Distribution (versions 2.x < 2.14.12, 3.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, and 4.4.x

CVE-2023-54405

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

GHSA-8MCX-5RQC-VHMF Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

Affected files dulwich/index.py Methods: validatepathelementntfs, treetofspath dulwich/porcelain/init.py Method: checkedworktreepath Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible for...

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

GHSA-CM62-GVXX-VMXX Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

CVE-2026-95369

An inappropriate implementation flaw was found in the XML component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/513049042...

EUVD-2023-60704

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405 H3C CVM Unauthenticated File Upload via fileUpload/upload Token

H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter...

CVE-2023-54405

The H3C CVM (Cloud Virtualization Management) component of the H3C CAS cloud platform is vulnerable to an unauthenticated arbitrary file upload flaw in the /cas/fileUpload/upload endpoint. The root cause is the lack of restrictions on file types and the failure to sanitize the caller-supplied tok...

CVE-2026-104851

A flaw was found in fsspec. This vulnerability can lead to arbitrary code execution due to unrestricted template evaluation in the ReferenceFileSystem component. When processing filesystem reference metadata documents, template expressions are evaluated without security restrictions or sandboxing...