CVE WATCH / VULNERABILITY DETAIL
CVE-2026-107356
HIGHCVSS 8.8NVD feed
Published 10 November 2026 · tracked since 11 November 2026
Description
U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-119303 MEDIUM 5.3
- CVE-2026-119035 MEDIUM 6.4
- CVE-2026-119034 MEDIUM 5.3
- CVE-2026-119032 MEDIUM 5.3
- CVE-2026-118439 MEDIUM 4.1
- CVE-2026-118420 MEDIUM 6.8
- CVE-2026-118418 MEDIUM 5.3
- CVE-2026-118041 HIGH 8.8
- CVE-2026-117523 MEDIUM 4.3
- CVE-2026-117522 MEDIUM 6.8