PT-2026-61834

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

CVE-2026-59143: Out-of-bounds Read

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rbcontainslocked. The attach-time validator rbvalidateheader checks the header scalars and region layout against the file size, but does not validate the...

PT-2026-62102

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. This leads to remote code execution as a...

PT-2026-62044

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx find locked. The attach-time validator rdx validate header checks the header scalars and region layout against the file size, but does not validate the node records it...

PT-2026-61987

Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox affected versions not specified Description A SQL injection and security boundary bypass issue exists in the prebuilt BigQuery forecasting tool bigquery-forecast. The tool accepts client-controlled parameters data col,...

PT-2026-62054

Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via an unvalidated parent index in dsu find. The attach-time validator dsu validate header checks the header scalars and region layout against the file size, but does not validate the array contents it th...

PT-2026-62050

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb contains locked. The attach-time validator rb validate header checks the header scalars and region layout against the file size, but does not validate th...

PT-2026-62053

Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph walk cell and sph alloc slot. The attach-time validator sph validate header checks the header scalars and region layout against the file size, but...

CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

MGASA-2026-0280 Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

CVE-2026-63428

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63428 HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without validating against the form's declared hidden-field set

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, completeSubmission accepts a hiddenFields: id, name, value array from the submitter and stores it verbatim in submission.hiddenFields, without validating the supplied id/name against the form's declared form.hiddenFields schema...

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-63102

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

EUVD-2026-45979

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist 'css','js','html','txt','json','sql','md' on content-write operations saveFile, createFile, but two destructive endpoints — deleteFileOrFolder and...