CVE-2026-78839: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

Linux Distros Unpatched Vulnerability : CVE-2026-76174

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admininfo endpoint. The application validates files solely based o...

CVE-2026-50894: Unrestricted Upload of File with Dangerous Type

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

PT-2026-85698

An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths...

CVE-2026-71620

File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file...

CVE-2026-75169

The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is affected by an arbitrary file upload vulnerability in the /cgi-bin/ugwupload.cgi component. A remote authenticated user with the Admin role can exploit this flaw to upload files containing arbitrary content to hardcoded paths . No spe...

PT-2026-86237

Name of the Vulnerable Software and Affected Versions ApiAdmin version 5.0.1 Description A file upload flaw allows a remote attacker to execute arbitrary code by uploading a specially crafted .php file. Recommendations At the moment, there is no information about a newer version that contains a f...

CVE-2026-50894

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

CVE-2026-81939: Improper Limitation of a Pathname to a Restricted Directory

A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...

PT-2026-85570

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

CVE-2026-50894

The software easyadmin v2.0.2.2 is vulnerable to an Unrestricted Upload of File with Dangerous Type within its background management interface. This flaw allows authenticated remote attackers to upload a crafted file, leading to arbitrary code execution and the acquisition of full server privileg...

CVE-2026-12483: Unrestricted Upload of File with Dangerous Type

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndashfileuploadprocess' function, which iterates through an entire array and validates only the first file. This...

PT-2026-86269

Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to...

CVE-2026-53769: Missing Authorization

Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks server-side upload authorization and bypasses the documented field-level upload policy methods such as uploadFIELDID?. An authenticated Avo...

PT-2026-85525

The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash fileupload process' function, which iterates through an entire array and validates only the first file. This...

CVE-2026-78839

AppNitro MachForm v30 is vulnerable to an arbitrary file upload vulnerability that enables remote code execution . An unauthenticated attacker can exploit this by uploading a crafted .phar file to a form that permits that extension. Successful exploitation requires the attacker to identify a form...

EUVD-2026-71772

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

CVE-2026-85208

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...

CVE-2026-13001

CVE-2026-13001 — Podlove Podcast Publisher Unauthenticated File Upload RCE isimage vs extractfileextension Mismatch → PHP Polyglot Upload Overview CVE-2026-13001 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Podlove Podcast Publisher WordPress plugin...

EUVD-2026-70732

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the function doInsert of the file /rider/orders/controller.php?action=add of the component Order Management Controller. Performing a manipulation of the argument image results in...