The vulnerability in the /web/jquery/uploader/multi Uploadify.php script of the D-Link DNS-320 network storage software allows a attacker to execute arbitrary code and gain full access to the system.

The vulnerability in the /web/jquery/uploader/multiUploadify.php script of the D-Link DNS-320 network storage software relates to the unlimited uploading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code and gain full access to the...

PT-2026-63552

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into...

CVE-2026-47247

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor WordPress, Sharp/libvips,...

CVE-2026-64879

Technical details about CVE-2026-64879 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789

CVE-2026-15789 affects the BuildKit daemon: a custom client with valid BuildKit API access can craft upload requests that bypass destination directory validation, allowing files to escape the BuildKit-controlled state directory. This is a local-privilege issue that requires access to the BuildKit...

CVE-2026-62415

Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets...

CVE-2026-62415

Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets...

EUVD-2026-46170

The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets...

CVE-2026-62415 Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2

The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets...

CVE-2026-62415

Affected software: Joomla extension Membership Pro (Joomla) prior to version 4.6.2. Issue: default configuration allowed unauthenticated users to upload media assets, enabling potential unauthorized media uploads. No further details on impact, exploit, or fixes are provided in the supplied docume...

CVE-2026-1771

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

EUVD-2026-46168

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

CVE-2026-1771

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

📄 WordPress Copymatic 1.6 Unauthenticated Shell Upload

WordPress Copymatic plugin version 1.6 contains an unauthenticated arbitrary file upload to remote code execution vulnerability. A remote attacker can upload executable PHP code and achieve remote code execution. This proof of concept exploit demonstrates the vulnerable request flow against the...

PT-2026-61846

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

EUVD-2026-39539

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup...

CVE-2026-53596

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the FreeScout helpdesk application does not enforce rate limiting on the file upload endpoint. Any user can flood the server with upload requests, leading to database overload and potentia...

CVE-2026-53596

CVE-2026-53596 affects FreeScout (Laravel-based help desk). Before version 1.8.224, the file upload endpoint lacks rate limiting, allowing unauthenticated users to flood uploads, risking database overload and DoS for all users. The cited fix is in FreeScout v1.8.224. No exploitation details are p...