CVE-2026-52703

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-35

Affected software

No affected versions have been published.

Timeline

Published
Jun 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-5270410.0Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code InCVE-2026-527059.0Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions.CVE-2026-527069.8Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.CVE-2026-527078.1Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.CVE-2026-52717.8pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory. CVE-2026-527117.5Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.CVE-2026-527127.6Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.CVE-2026-527145.9Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.CVE-2026-527159.3Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.CVE-2026-527166.5Unauthenticated Arbitrary File Deletion in WorkScout-Core <= 1.7.11 versions.CVE-2026-527186.5A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad. The gst_av1_parser_parse_tile_list_obu() funCVE-2026-527197.1An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length