PT-2026-71974

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.0.4 Description An authenticated user with Author level privileges or higher can achieve remote code execution by uploading a malicious Postscript file. This issue occurs when the server utilizes Imagick and...

CVE-2026-18962: Authorization Bypass Through User-Controlled Key

The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it processes a front-end upload, allowing any authenticated user, such as a Subscriber, to upload files into albums owned by other users or by the...

PT-2026-75930

Impact Affected versions of Winter CMS did not enforce per-template-type permission checks in the CMS section's AJAX handlers. The CMS controller CmsControllersIndex used OR-logic across its five permissions cms.manage pages, cms.manage partials, cms.manage layouts, cms.manage content, cms.manage...

Blocksy Companion <= 2.1.46 - Unauthenticated File Upload RCE (CVE-2026-58480)

CVE-2026-58480: unauthenticated arbitrary file upload via blc-review-images in blcsavereviewattachments. Double-extension bypass .woff2.php when Advanced Reviews and Custom Fonts are enabled. Fixed in 2.1.47. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json...

CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-48763 TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at "GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url" that accepts an attacker-controlled "filePath" and returns a presigned S3 "PUT" URL for that exact key. Because the endpoint...

CVE-2026-48763

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

EUVD-2026-56979

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-55676

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

EUVD-2026-56948

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

CVE-2026-55676

Malcolm’s file-upload PHP backend allows unrestricted uploads: an empty allow-list means any extension is accepted, and the filename sanitizer preserves .php. Uploaded files land under /var/www/upload/server/php/files and are served via nginx to php-fpm, enabling an authenticated GET to execute t...

CVE-2026-55676 Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...

GHSA-3RRR-JR9J-H3Q3 vulnerabilities

Vulnerabilities for packages: langfuse, jupyter-base-notebook...

CVE-2026-73034

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034 DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

CVE-2026-73034

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...