CVE-2026-39752 — Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
Contributor Arbitrary File Deletion in Jobs for WordPress <= 2.8.2 versions.
CVSS 7.7
NVD · CVE récentesCWE-22
Cyber Threat Dashboard
Veille cybersécurité : alertes, vulnérabilités, actualités et outils pour se protéger.
1756Éléments
12557 derniers jours
76Aujourd'hui
755Critique + haute
09/10/2026 23:28Dernière collecte
CVE-2026-105751 — Docling simplifies document processing by parsing diverse formats and providing integrations with the generat…
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attr…
NVD · CVE récentesCWE-22
CVE-2026-105744 — Docling simplifies document processing by parsing diverse formats and providing integrations with the generat…
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic")…
CVSS 7.5
CVE-2026-102262 — Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working director…
Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working director…
CVSS 7.3
CVE-2026-95264 — Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permiss…
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a file…
CVSS 6.5
NVD · CVE récentesCWE-22
CVE-2026-105677 — Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads th…
Ghost is a Node.js content management system. From 6.10.3 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to execute arbitrary code on the server via a cra…
CVSS 7.2
CVE-2026-105676 — Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads th…
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read JSON files outside of the active theme's …
CVSS 4.9
CVE-2026-12171 — auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file…
auto-changelog before 2.6.1 merges configuration from inside the target repository (the .auto-changelog file and the auto-changelog key in package.json) into its options, and honors security-sensitive options from that …
CVSS 7.8
CVE-2026-88396 — ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Ind…
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content…
CVSS 7.2
NVD · CVE récentesCWE-22
CVE-2026-89039 — A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playw…
A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and receive the contents of any file readable by the user running the server, including …
CVSS 6.5
CVE-2026-88394 — WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/proj…
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted…
CVSS 7.5
NVD · CVE récentesCWE-22
CVE-2026-88392 — Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to e…
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
CVSS 7.5
NVD · CVE récentesCWE-22