PYSEC-2026-3466 Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

Header | Field | Value | |---|---| | Title | Extension-denylist bypass via case-folding asymmetry in name-override path incomplete-fix variant of CVE-2026-27641 | | Project | Flask-Reuploaded flaskuploads | | Affected | extension"shell.php" = "php" - extensionallowed"php" - DENY correct...

CVE-2026-65461

The WordPress plugin Really Simple CSV Importer (vulnerable:

EUVD-2026-48225

Administrator Arbitrary File Upload in Really Simple CSV Importer = 1.3 versions...

EUVD-2026-48220

Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...

CVE-2026-65455

CVE-2026-65455 affects the WordPress MapSVG plugin up to version 8.14.0. The vulnerability is described as an Administrator Arbitrary File Upload, with an overall CVSSv3.1 base score of 9.1 (CRITICAL) and a network attack vector, requiring high privileges and no user interaction. The reports do n...

CVE-2026-27064

CVE-2026-27064 affects the WordPress Mailster plugin, versions

EUVD-2026-48151

Editor Arbitrary File Upload in Mailster = 4.1.17 versions...

CVE-2026-14282

The CVE describes a vulnerability in the GoDAM WordPress plugin (versions up to and including 1.12.2) where an insufficient file type validation in save_video_file() (hooked to WPForms process) trusts the attacker-controlled Content-Type header, preserves the original filename via wp_unique_filen...

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

PT-2026-64000

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the file upload functionality within the DataHub module. Authenticated attackers can use a crafted filename to perfo...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

MAL-2026-11002 Malicious code in habinger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...

GO-2026-6037 Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload in gitea.dev

Gitea: Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload in gitea.dev...

GO-2026-6021 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser...

MAL-2026-10995 Malicious code in habingeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716d1a3d9969396f8ca204c03d403552bb4a990c1bfdb4a2ab05dff5afb93748 package.json declares postinstall: node test.js, which auto-runs on npm install and invokes two functions from index.js. The first recursively walks...

MAL-2026-10994 Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

Allocation of Resources Without Limits or Throttling

Overview elgg/elgg is a development framework used for creating socially aware web applications. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the avatar upload process. An attacker can cause resource exhaustion by uploading an image...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...

CVE-2026-65650

Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...