Delta Sql 1.8.2 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requests to docs_upload.php with crafted multipart form. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Symlink-based mount escape in libfuse sshfs 3.7.5 and earlier lets a malicious or compromised SSH server craft symlink targets (absolute paths or targets containing '..') that the sshfs client passes unchecked to the local kernel, enabling local file reads and writes outside the intended mount root when the mounting user traverses them. Rated CVSS 9.3 (scope-changed) and tracked as a link-following flaw (CWE-59); no public exploit identified at time of analysis, and EPSS is very low at 0.03% (10th percentile). The fix introduces default symlink containment shipped in sshfs 3.7.6.