CVE-2016-1000031
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
CVSS
9.8
Critical
EPSS
33.7%
p98
KEV
—
Exploit Today
30
0-100
Published: Oct 25, 2016 · Last modified: Oct 7, 2026 · CWE-284
33.7%EPSS · 30 days33.7%
2026-09-232026-10-21
Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/93604
- www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-16-570/
- issues.apache.orghttps://issues.apache.org/jira/browse/FILEUPLOAD-279
- issues.apache.orghttps://issues.apache.org/jira/browse/WW-4812
- lists.apache.orghttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- lists.apache.orghttps://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190212-0001/
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
- www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1140546.5 MED18.8%
——6vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt. Attackers can set a UUID EXIF ImageID to receive another request's cached processed media, or match cache_salt to a LoRA name to reuse first-block KV state.2dCVE-2026-1137063.5 LOW15.4%
——5A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.2dCVE-2026-113297—12.0%
——4Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2026-113196—13.5%
——4Improper access control in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2026-113159—10.5%
——3Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)2dCVE-2026-113129—7.0%
——2Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)2d