CVE-2026-91844 | High | 7.3 | 2026-10-08 | Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files… |
CVE-2026-85097 | Critical | 9.8 | 2026-10-08 | The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insuffici… |
CVE-2026-17609 | Critical | 9.1 | 2026-10-08 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via… |
CVE-2026-17196 | High | 8.8 | 2026-10-08 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 vi… |
CVE-2026-92532 | | | 2026-10-07 | Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could modify the app… |
CVE-2026-105868 | | | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload config… |
CVE-2026-105862 | High | 8.7 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that a… |
CVE-2026-104069 | High | 7.2 | 2026-10-06 | HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the… |
CVE-2026-39770 | Critical | 10.0 | 2026-10-06 | Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. |
CVE-2026-39759 | Critical | 9.9 | 2026-10-06 | Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions. |
CVE-2026-39757 | Critical | 9.9 | 2026-10-06 | Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. |
CVE-2026-39755 | Critical | 9.9 | 2026-10-06 | Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. |
CVE-2026-32579 | Critical | 10.0 | 2026-10-06 | Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions. |
CVE-2026-105701 | High | 8.8 | 2026-10-06 | The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is du… |
CVE-2026-82988 | High | 7.5 | 2026-10-06 | There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unp… |
CVE-2026-105679 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from… |
CVE-2026-105651 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 5.94.0 until 6.64.0, when creating a bookmark card, Ghost could store non-image files fetched from an extern… |
CVE-2026-105649 | High | 7.3 | 2026-10-05 | Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored… |
CVE-2026-105389 | Medium | 6.3 | 2026-10-05 | A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. This issue affects some unknown processing of the file App/Feelcrm/Crm/Controller/… |
CVE-2026-105644 | Medium | 6.8 | 2026-10-05 | Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitization. An attacker who… |
CVE-2026-105630 | High | 8.7 | 2026-10-05 | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xm… |
CVE-2026-104890 | High | 7.2 | 2026-10-05 | Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php… |
CVE-2026-104811 | | | 2026-10-05 | DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication… |
CVE-2026-104805 | | | 2026-10-05 | DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to… |
CVE-2026-105123 | High | 8.8 | 2026-10-04 | W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing th… |
CVE-2023-54405 | Critical | 9.8 | 2026-10-02 | H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /c… |
CVE-2026-104637 | High | 7.3 | 2026-10-02 | A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function… |
CVE-2026-104471 | High | 7.2 | 2026-10-02 | YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ d… |
CVE-2026-92820 | High | 8.1 | 2026-10-02 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external (A… |
CVE-2026-56660 | Critical | 9.1 | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in Upda… |
CVE-2026-64949 | | | 2026-10-01 | Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwa… |
CVE-2026-64947 | | | 2026-10-01 | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, result… |
CVE-2026-103541 | Medium | 6.3 | 2026-10-01 | A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/code/actions.php of… |
CVE-2026-76144 | | | 2026-10-01 | An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL PNS allows an attacker to upload a dan… |
CVE-2026-102143 | High | 7.5 | 2026-09-30 | An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload hand… |
CVE-2026-102137 | Medium | 4.1 | 2026-09-30 | An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on th… |
CVE-2026-102130 | High | 7.2 | 2026-09-30 | Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influence how the applicati… |
CVE-2026-103474 | High | 8.8 | 2026-09-30 | yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attacke… |
CVE-2026-102427 | Critical | 10.0 | 2026-09-30 | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s… |
CVE-2026-102454 | High | 7.2 | 2026-09-30 | EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby… |
CVE-2026-75873 | Critical | 9.8 | 2026-09-30 | The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenti… |
CVE-2026-102842 | Medium | 6.3 | 2026-09-30 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_use… |
CVE-2026-70356 | Critical | 9.1 | 2026-09-29 | The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web ser… |
CVE-2026-96431 | | | 2026-09-29 | Unrestricted Upload of File with Dangerous Type in the
/WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version
before 2023/03/24 allo… |
CVE-2026-102263 | Medium | 4.7 | 2026-09-29 | A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected element is an unknown function of the file… |
CVE-2026-102366 | Medium | 4.4 | 2026-09-29 | mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file type… |
CVE-2026-54675 | | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionali… |
CVE-2026-101071 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/uplo… |
CVE-2026-12264 | High | 8.8 | 2026-09-28 | Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code executi… |
CVE-2026-12269 | High | 8.8 | 2026-09-28 | Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue co… |
CVE-2026-85134 | High | 8.8 | 2026-09-28 | Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Up… |
CVE-2026-82901 | Critical | 9.8 | 2026-09-26 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Arbitrary File Upload due to insufficient file type validation in the 'uacf7_wpcf7_ma… |
CVE-2026-94132 | | | 2026-09-26 | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of i… |
CVE-2026-18143 | Critical | 9.8 | 2026-09-26 | The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_subm… |
CVE-2026-100389 | High | 8.1 | 2026-09-25 | GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file… |
CVE-2026-42322 | Critical | 9.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content b… |
CVE-2026-13249 | Critical | 9.8 | 2026-09-24 | An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F… |
CVE-2026-13248 | High | 8.8 | 2026-09-24 | An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in… |
CVE-2026-96515 | | | 2026-09-24 | This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient
authorization and input validation controls in the diagnostic script import
fun… |
CVE-2026-93352 | Critical | 9.8 | 2026-09-23 | Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blockli… |
CVE-2026-96513 | High | 7.3 | 2026-09-23 | A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation… |
CVE-2026-5695 | | | 2026-09-23 | Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without r… |
CVE-2026-95830 | Medium | 6.3 | 2026-09-23 | A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the f… |
CVE-2026-95820 | Medium | 6.3 | 2026-09-22 | A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is some unknown functio… |
CVE-2026-88419 | High | 8.8 | 2026-09-22 | An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows a… |
CVE-2026-95500 | High | 7.3 | 2026-09-22 | A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.ph… |
CVE-2026-95499 | High | 7.3 | 2026-09-22 | A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.ph… |
CVE-2026-88738 | High | 8.8 | 2026-09-21 | Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administr… |
CVE-2026-88745 | Medium | 6.1 | 2026-09-21 | EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. |
CVE-2026-52835 | | | 2026-09-21 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of impor… |
CVE-2026-36467 | High | 7.2 | 2026-09-21 | Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manage… |
CVE-2026-94383 | | | 2026-09-21 | The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied w… |
CVE-2026-82187 | Critical | 9.8 | 2026-09-21 | The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those… |
CVE-2026-88857 | | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions save… |
CVE-2026-94104 | High | 8.8 | 2026-09-20 | NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new file… |
CVE-2026-81650 | High | 7.2 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not correctly validate the extensions of files extracted from an uploaded archive… |
CVE-2026-84750 | Medium | 6.5 | 2026-09-19 | The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, an… |
CVE-2026-84434 | Critical | 9.8 | 2026-09-19 | The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This… |
CVE-2026-93031 | High | 8.8 | 2026-09-18 | The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all version… |
CVE-2026-77929 | High | 8.8 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file w… |
CVE-2026-56590 | Medium | 6.4 | 2026-09-18 | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthent… |
CVE-2026-45140 | Critical | 9.8 | 2026-09-17 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on th… |
CVE-2026-92980 | High | 7.2 | 2026-09-17 | HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary OS commands as… |
CVE-2026-87935 | High | 8.1 | 2026-09-17 | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler functio… |
CVE-2026-87796 | Critical | 9.8 | 2026-09-17 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file… |
CVE-2026-76552 | High | 8.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it retrieves from a user-supplied URL during… |
CVE-2026-78088 | High | 8.8 | 2026-09-16 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in… |
CVE-2026-92247 | Medium | 4.7 | 2026-09-16 | A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of th… |
CVE-2026-81240 | High | 8.6 | 2026-09-15 | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
CVE-2026-81239 | High | 8.6 | 2026-09-15 | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
CVE-2026-81236 | High | 8.6 | 2026-09-15 | Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attack… |
CVE-2026-91849 | Medium | 6.3 | 2026-09-15 | A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of… |
CVE-2026-91005 | Medium | 6.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_pictu… |
CVE-2026-90857 | Medium | 6.3 | 2026-09-15 | A vulnerability was detected in SourceCodester College Notes Gallery Management System 1.0. Affected is an unknown function of the file /dashboard/userprofile… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-57581 | Medium | 5.3 | 2026-09-14 | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, applications with configured file upload stor… |
CVE-2026-54567 | High | 7.5 | 2026-09-14 | Flask-Reuploaded provides file uploads for Flask. From 1.5.0 until 1.6.0, UploadSet.save(storage, name=...) in src/flask_uploads/flask_uploads.py applies lower… |
CVE-2026-54177 | Medium | 6.6 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54087 | High | 7.6 | 2026-09-14 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable upload… |
CVE-2026-82793 | High | 7.2 | 2026-09-14 | Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is… |