CVE ID :CVE-2026-92895 Published : 6 Nov 2026, 12:17 p.m. | 53 minutes ago Description :The Live2DWebCanvas plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.2.1 via the download_one_file function. This is due to missing file extension...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-92895 - Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameter

VERWANDTEARTIKEL

CVE-2025-71457

LibreOffice: Schwachstelle ermöglicht Denial-of-Service

CVE-2026-85111 - Apache James: Denial of service upon MIME parsing

CVE-2026-116624 - Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Form

CVE-2026-107622 - BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter

CVE-2026-114630 - ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter