PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

PT-2026-98980

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cau...

CVE-2026-100389: Unrestricted Upload of File with Dangerous Type

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

PT-2026-98855

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue exists in the Universal Connector Oracle Wallet upload component. This allows an authenticated remote attacker to write arbitrary files to the system. Path traversal ...

PT-2026-98392

Name of the Vulnerable Software and Affected Versions Modula Image Gallery – Photo Grid & Video Gallery versions prior to 3.0.3 Description Insufficient file path validation in the upload image function allows authenticated attackers with author-level access or higher to delete arbitrary files on...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-99096

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.6 Description A remote cross-site scripting issue exists due to improper processing within the Sanitizer.php file of the TinyMCE Media Upload component. Cross-site scripting is a technique where malicio...

CVE-2026-85750: Improper Input Validation

Piwigo before v16.4.0 is vulnerable to arbitrary file read and remote code execution in image upload handling when using the Imagick library due to insufficient validation and unsafe processing of user-supplied image files. By abusing format confusion e.g., disguising SVG content as PNG, an...

PT-2026-98951

Name of the Vulnerable Software and Affected Versions @payloadcms/storage-vercel-blob affected versions not specified Description Improper access control in the storage adapter allows authenticated users to bypass collection-level permissions. By directly accessing the 'client-upload' endpoint,...

CVE-2026-93363: Missing Authorization

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

Dell Wyse Management Suite < 2605.0.3.683 Multiple Vulnerabilities (DSA-2026-387)

The version of Dell Wyse Management Suite installed on the remote host is prior to 2605.0.3.683. It is, therefore, affected by multiple vulnerabilities, including: - Dell Wyse Management Suite WMS, versions prior to WMS 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type...

CVE-2026-97322

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97323

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-13249

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this...

CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97323

A path traversal vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (up to version 2026.08). The flaw resides in the getOriginalFilename function within the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.ja...

CVE-2026-97323 YunaiV/zhijiantianya ruoyi-vue-pro File Upload MpMaterialServiceImpl.java getOriginalFilename path traversal

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

EUVD-2026-86405

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97322 YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in...

CVE-2026-97322

A cross-site scripting (XSS) vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (versions up to 2026.08). The flaw affects an unspecified function within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileControll...