PULSEUnderground Intel

EN VIVO45señales / 24h

FEED

ransomrhysida reclama a Law Offices of R. David Williams, P.A. · US · Professional Servicesransomulose reclama a www.newyjh.com · KR · Not Foundransomstorm reclama a West County Health Centers · US · Healthcareransomstorm reclama a Gardeners' Guild · US · Agriculture and Food Productionransomthegentlemen reclama a LegalWise · ZA · Professional Servicesransomthegentlemen reclama a Samwumed · KR · Healthcareransomthegentlemen reclama a Edcon · ZA · Manufacturingransomthegentlemen reclama a Defencebit · GB · Government & Defenseransomthegentlemen reclama a Datacomm Services · US · Technologyransomthegentlemen reclama a Webb Electric Company of Florida · US · Energy & Utilitiesransomthegentlemen reclama a Solaria · ID · Energy & Utilitiesransomthegentlemen reclama a Auren · ES · Professional Servicesransomthegentlemen reclama a QUALITY SPORT Topsport Italia · IT · Retail & E-Commerceransomthegentlemen reclama a Europrim · FR · Healthcareransomrhysida reclama a Law Offices of R. David Williams, P.A. · US · Professional Servicesransomulose reclama a www.newyjh.com · KR · Not Foundransomstorm reclama a West County Health Centers · US · Healthcareransomstorm reclama a Gardeners' Guild · US · Agriculture and Food Productionransomthegentlemen reclama a LegalWise · ZA · Professional Servicesransomthegentlemen reclama a Samwumed · KR · Healthcareransomthegentlemen reclama a Edcon · ZA · Manufacturingransomthegentlemen reclama a Defencebit · GB · Government & Defenseransomthegentlemen reclama a Datacomm Services · US · Technologyransomthegentlemen reclama a Webb Electric Company of Florida · US · Energy & Utilitiesransomthegentlemen reclama a Solaria · ID · Energy & Utilitiesransomthegentlemen reclama a Auren · ES · Professional Servicesransomthegentlemen reclama a QUALITY SPORT Topsport Italia · IT · Retail & E-Commerceransomthegentlemen reclama a Europrim · FR · Healthcare

← Todos los CVEs

CVE Watch30 sept 2026

CVE-2026-94123

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

CVSS

7.5

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 30 sept 2026 · Última mod.: 30 sept 2026 · CWE-22

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-nextgen-gallery-plugin-4-5-0-arbitrary-file-download-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-972426.8 MED

———Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions.3h CVE-2026-968246.8 MED

———Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.3h CVE-2026-750987.5 ALT

———The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The endpoint's only authentication gate relies on a nonce and token that are both publicly emitted as JavaScript globals on any page rendering the [pdapp-studio-page] shortcode, making them freely obtainable by anonymous visitors.3h CVE-2026-1024576.5 MED

———EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.8h CVE-2026-1028434.7 MED

———A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.3h CVE-2026-86136—

——0A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.17h