CVE-2026-19903 | Medium | 5.3 | 2026-08-15 | A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Data… |
CVE-2026-8715 | Critical | 9.6 | 2026-08-13 | Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration… |
CVE-2026-73653 | Critical | 9.4 | 2026-08-13 | Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreensh… |
CVE-2026-14849 | Low | 3.7 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not protect the member and payment export files it writes to a predictable location in th… |
CVE-2026-11841 | Critical | 9.4 | 2026-07-28 | An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access r… |
CVE-2026-57990 | High | 7.4 | 2026-07-26 | Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-15342 | Medium | 6.5 | 2026-07-21 | Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate… |
CVE-2026-59703 | High | 7.5 | 2026-07-08 | repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories… |
CVE-2026-13533 | Medium | 5.3 | 2026-06-29 | A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/conf… |
CVE-2025-66389 | High | 7.5 | 2026-06-22 | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Theref… |
CVE-2026-40624 | Critical | 9.8 | 2026-06-19 | Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+
cameras may allow a remote, unauthenticated attacker to achieve
arbitrary code execut… |
CVE-2025-14771 | Critical | 9.9 | 2026-06-03 | Files or directories accessible to external parties vulnerability in ABB T-MAC Plus.
This issue affects T-MAC Plus: 4.0-24. |
CVE-2026-45543 | Medium | 5.3 | 2026-06-01 | Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access… |
CVE-2026-40425 | Medium | 5.7 | 2026-05-29 | The administrator account for the
Danelec MacGregor Voyage Data Recorder
web interface can directly edit sensitive files related to authentication, potentiall… |
CVE-2026-45088 | High | 7.5 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload… |
CVE-2024-56462 | High | 7.2 | 2026-05-27 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain… |
CVE-2024-11399 | Medium | 6.8 | 2026-05-27 | Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local us… |
CVE-2026-45721 | Critical | 9.0 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without an index f… |
CVE-2026-40564 | Medium | 6.5 | 2026-05-26 | Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Kubernetes Operator.
The FlinkSessionJob… |
CVE-2026-8704 | Medium | 6.5 | 2026-05-15 | Crypt::DSA versions through 1.19 for Perl use 2-args open, allowing existing files to be modified. |
CVE-2026-33380 | Medium | 6.3 | 2026-05-13 | A vulnerability in SQL Expressions allows an authenticated attacker to read arbitrary files from the Grafana server's filesystem. Only instances with the sqlEx… |
CVE-2026-42063 | Medium | 4.9 | 2026-05-13 | A vulnerability exists in iControl SOAP where an authenticated attacker with the Resource Administrator or Administrator role can download sensitive files. No… |
CVE-2026-40631 | High | 8.7 | 2026-05-13 | An authenticated attacker with the Resource Administrator or Administrator role can modify configuration objects through iControl SOAP resulting in privilege e… |
CVE-2026-35440 | Medium | 5.5 | 2026-05-12 | Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2026-32185 | Medium | 5.5 | 2026-05-12 | Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally. |
CVE-2026-31216 | Critical | 9.1 | 2026-05-12 | The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/{obj… |
CVE-2026-31215 | Critical | 9.1 | 2026-05-12 | The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface. The DELETE /{index_n… |
CVE-2026-39871 | High | 7.5 | 2026-05-11 | A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. An app may be able… |
CVE-2026-7817 | Medium | 6.5 | 2026-05-11 | Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.
User-supplied api_key_file and… |
CVE-2026-6418 | Medium | 4.9 | 2026-05-05 | An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configu… |
CVE-2026-5335 | Medium | 5.3 | 2026-05-04 | The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to lea… |
CVE-2025-69428 | High | 7.5 | 2026-04-27 | An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories. |
CVE-2026-40484 | Critical | 9.1 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents… |
CVE-2025-7389 | | | 2026-04-14 | A vulnerability in the AdminServer component of OpenEdge on all supported platforms grants its authenticated users OS-level access to the server
through the ad… |
CVE-2019-25709 | Critical | 9.8 | 2026-04-12 | CF Image Hosting Script 1.6.5 allows unauthenticated attackers to download and decode the application database by accessing the imgdb.db file in the upload/dat… |
CVE-2026-33698 | Critical | 9.8 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allo… |
CVE-2021-47960 | Medium | 6.5 | 2026-04-10 | A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within… |
CVE-2026-35446 | High | 7.7 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-35169 | High | 8.7 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-34392 | High | 7.5 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-34785 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a stati… |
CVE-2026-34361 | Critical | 9.3 | 2026-03-31 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP servic… |
CVE-2026-4900 | Medium | 5.3 | 2026-03-26 | A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulat… |
CVE-2021-4474 | Medium | 4.9 | 2026-03-26 | Ruckus Access Point products contain an arbitrary file read vulnerability in the command-line interface that allows authenticated remote attackers with adminis… |
CVE-2026-4760 | | | 2026-03-25 | From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servi… |
CVE-2026-4532 | Medium | 5.3 | 2026-03-22 | A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-33071 | Medium | 4.3 | 2026-03-20 | FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml… |
CVE-2026-32750 | Medium | 6.8 | 2026-03-19 | SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importStdMd passes the localPath parameter directly to model.Im… |
CVE-2016-20025 | High | 8.8 | 2026-03-16 | ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying exec… |
CVE-2025-66955 | Medium | 6.5 | 2026-03-12 | Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via "… |
CVE-2026-29066 | Medium | 6.2 | 2026-03-12 | Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.strict: false, which disables Vite's bu… |
CVE-2018-25164 | High | 7.5 | 2026-03-06 | EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from… |
CVE-2026-2331 | Critical | 9.8 | 2026-03-06 | An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access r… |
CVE-2026-2330 | Critical | 9.4 | 2026-03-06 | An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories inte… |
CVE-2026-24732 | | | 2026-03-04 | Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extensi… |
CVE-2026-25231 | High | 7.5 | 2026-02-09 | FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to… |
CVE-2020-37082 | Critical | 9.8 | 2026-02-03 | webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database backup files without authentication. Atta… |
CVE-2025-69875 | High | 7.8 | 2026-02-03 | A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore paths and improper p… |
CVE-2026-25137 | Critical | 9.1 | 2026-02-02 | The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database m… |
CVE-2025-37177 | Medium | 6.5 | 2026-01-13 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating syst… |
CVE-2025-37168 | High | 8.2 | 2026-01-13 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation… |
CVE-2025-69990 | Critical | 9.1 | 2026-01-13 | phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted. |
CVE-2025-66689 | Medium | 6.5 | 2026-01-12 | A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerabili… |
CVE-2025-68719 | High | 8.8 | 2026-01-08 | KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker ca… |
CVE-2025-12648 | Medium | 5.3 | 2026-01-07 | The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user… |
CVE-2025-15065 | Medium | 6.3 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi… |
CVE-2025-15153 | Low | 3.7 | 2025-12-28 | A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Execut… |
CVE-2019-25239 | High | 7.5 | 2025-12-24 | V-SOL GPON/EPON OLT Platform 2.03 contains an unauthenticated information disclosure vulnerability that allows attackers to download configuration files via di… |
CVE-2018-25145 | Medium | 6.5 | 2025-12-24 | Microhard Systems IPn4G 1.1.0 contains a configuration file disclosure vulnerability that allows authenticated attackers to download sensitive system configura… |
CVE-2025-14896 | High | 7.5 | 2025-12-18 | due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious… |
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-14697 | Low | 3.7 | 2025-12-15 | A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknow… |
CVE-2025-14442 | Medium | 5.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV file… |
CVE-2025-66625 | Medium | 4.9 | 2025-12-09 | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a… |
CVE-2025-12747 | Medium | 5.3 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being… |
CVE-2025-12894 | Medium | 5.3 | 2025-11-21 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2025-64185 | | | 2025-11-20 | Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open On… |
CVE-2025-13225 | Medium | 5.6 | 2025-11-19 | Tanium addressed an arbitrary file deletion vulnerability in TanOS. |
CVE-2025-13200 | Medium | 5.3 | 2025-11-15 | A vulnerability was determined in SourceCodester Farm Management System 1.0. Affected by this vulnerability is an unknown functionality. This manipulation caus… |
CVE-2021-4463 | | | 2025-11-12 | Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. T… |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-33150 | Medium | 5.3 | 2025-11-10 | IBM Cognos Analytics Certified Containers 12.1.0 could disclose package parameter information due to the presence of hidden pages. |
CVE-2025-58152 | Medium | 5.3 | 2025-10-31 | FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. Wi… |
CVE-2025-11965 | High | 7.5 | 2025-10-22 | In Eclipse Vert.x versions [4.0.0, 4.5.21] and [5.0.0, 5.0.4], a StaticHandler configuration for restricting access to hidden files fails to restrict access to… |
CVE-2025-31996 | Medium | 5.3 | 2025-10-13 | HCL Unica Platform is affected by unprotected files due to improper access controls. These files may contain sensitive information such as private or system… |
CVE-2025-11371 | High | 7.5 | 2025-10-09 | In the default installation and configuration of Gladinet CentreStack and TrioFox, there is an unauthenticated Local File Inclusion Flaw that allows unintended… |
CVE-2025-59976 | Medium | 6.5 | 2025-10-09 | An arbitrary file download vulnerability in the web interface of Juniper Networks Junos Space allows a network-based authenticated attacker using a crafted GET… |
CVE-2025-61734 | High | 7.5 | 2025-10-02 | Files or Directories Accessible to External Parties vulnerability in Apache Kylin.
You are fine as long as the Kylin's system and project admin access is well… |
CVE-2025-37130 | Medium | 6.5 | 2025-09-16 | A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful… |
CVE-2025-3025 | High | 7.3 | 2025-09-15 | Elevation of Privileges in the cleaning feature of Gen Digital CCleaner version 6.33.11465 on Windows allows a local user to gain SYSTEM privileges via exploit… |
CVE-2025-59054 | | | 2025-09-12 | dstack is a software development kit (SDK) to simplify the deployment of arbitrary containerized apps into trusted execution environments. In versions of dstac… |
CVE-2025-58753 | High | 7.5 | 2025-09-09 | Copyparty is a portable file server. In versions prior to 1.19.8, there was a missing permission-check in the shares feature (the `shr` global-option). When a… |
CVE-2025-9273 | Medium | 4.3 | 2025-09-02 | CData API Server MySQL Misconfiguration Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on a… |
CVE-2025-52460 | Medium | 5.3 | 2025-08-28 | Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded f… |
CVE-2025-43758 | Medium | 5.3 | 2025-08-22 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-51818 | Medium | 5.4 | 2025-08-21 | MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands |
CVE-2009-10005 | | | 2025-08-20 | ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticat… |
CVE-2025-43749 | Medium | 5.3 | 2025-08-20 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-44779 | Medium | 6.6 | 2025-08-07 | An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. |
CVE-2025-23276 | High | 7.8 | 2025-08-02 | NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead… |