CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

GHSA-P8V3-89RH-JXC7 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the restore staging process to write attacker-controlled files into the live Nginx configuration path even when both restorenginx and restorenginxui are set to false. Details The restore...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2026-107806

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-107806

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-107806

The Nginx UI web user interface (versions 2.3.8 until 2.5.0 ) is vulnerable to Remote Code Execution due to an insecure backup restoration flow. An authenticated administrator with an active secure session can submit attacker-controlled backup key material and a manifest via POST /api/restore . T...

CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

cve-2025-66398

CVE-2025-66398 — Signal K Server RCE PoC 📜 Description CVE-2025-66398 is a Signal K Server issue where an unauthenticated attacker can poison the server’s restore state via /skServer/validateBackup, then hijack config via /skServer/restore to inject a backdoor admin account and optionally achieve...

GO-2026-6629 vulnerabilities

Vulnerabilities for packages: typescript, kube-bench, commercial-gitlab-workhorse-ee, commercial-gitlab-workhorse-ee-fips, kube-bench-fips, ldap2pg, ldap2pg-fips, tigera-operator, backup-restore-operator, grafana, kube-state-metrics, wavefront-collector-for-kubernetes, timescaledb-parallel-copy,...

CVE-2026-56851 vulnerabilities

Vulnerabilities for packages: typescript, kube-bench, commercial-gitlab-workhorse-ee, commercial-gitlab-workhorse-ee-fips, kube-bench-fips, ldap2pg, ldap2pg-fips, tigera-operator, backup-restore-operator, grafana, kube-state-metrics, wavefront-collector-for-kubernetes, timescaledb-parallel-copy,...

PT-2026-108935

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.3.8 through 2.4.x Description An authenticated administrator with an active secure session can achieve remote code execution by exploiting the backup restore flow. By submitting attacker-controlled portable backup key...

PT-2026-109313

Name of the Vulnerable Software and Affected Versions Shiny for Python versions 1.4.0 through 1.6.3 Description The bookmark restore process accepts a client-supplied state id query-string value and joins it into the server-side bookmark directory without proper validation. An unauthenticated...

CVE-2026-107806: Improper Control of Generation of Code

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-25589-25588-25243-23631-23479-REDIS

GUIDE TO CHECKING & REMEDIATING 5 REDIS CVEs AS OF 2026.05.08 Release date: 2026-05-08 Author: TonyCao [email protected] Source: Redis Security Advisory TABLE OF CONTENTS 1. Overview 2. Affected Versions 3. Details of Each CVE CVE-2026-23479 — Use-after-free in Unblock Client Flow...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

CVE-2026-86826

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-86828 BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

EUVD-2026-94749

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

CVE-2026-86828

The BackWPup WordPress plugin (versions prior to 5.7.7 ) is vulnerable to a path traversal flaw during the backup restore process. When the plugin's fallback archive library is utilized, it fails to properly restrict the destination path of extracted files. This allows high-privileged users to wr...