CVE-2026-34492 | | | 2026-08-14 | External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation.
This issue affects Airwall: before 4.1. |
CVE-2026-17184 | Critical | 9.8 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path. |
CVE-2026-72842 | Critical | 9.9 | 2026-08-13 | luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes with… |
CVE-2026-72841 | Critical | 9.9 | 2026-08-13 | luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write a… |
CVE-2026-17482 | Critical | 9.8 | 2026-08-13 | IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths. |
CVE-2026-45725 | | | 2026-08-13 | compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching… |
CVE-2026-16987 | High | 8.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable. |
CVE-2026-16898 | High | 7.8 | 2026-08-13 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-co… |
CVE-2026-73619 | Medium | 6.5 | 2026-08-13 | GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers… |
CVE-2026-17431 | Medium | 6.1 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for… |
CVE-2026-65941 | High | 8.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in… |
CVE-2026-65939 | Medium | 6.8 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS we… |
CVE-2026-18048 | High | 7.5 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint… |
CVE-2026-72742 | High | 8.6 | 2026-08-11 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model o… |
CVE-2026-18127 | High | 7.7 | 2026-08-11 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an… |
CVE-2026-19353 | Medium | 5.0 | 2026-08-09 | A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component I… |
CVE-2026-17014 | Medium | 5.3 | 2026-08-09 | The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing… |
CVE-2026-54200 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in
the send email, fax, SMS, etc. functionality. By specifying… |
CVE-2026-12070 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion
vulnerability in the send email, fax, SMS, etc. functionality. By
speci… |
CVE-2026-19011 | Medium | 5.3 | 2026-08-06 | A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Perfor… |
CVE-2026-19009 | High | 7.3 | 2026-08-06 | A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Messa… |
CVE-2026-16054 | Critical | 9.1 | 2026-08-06 | The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that i… |
CVE-2026-60009 | High | 8.8 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The han… |
CVE-2026-15307 | High | 8.8 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.
GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster… |
CVE-2026-18806 | High | 7.1 | 2026-08-04 | External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Cl… |
CVE-2026-66310 | High | 7.7 | 2026-08-04 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-65802 | High | 7.4 | 2026-08-04 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. |
CVE-2026-64816 | Medium | 6.5 | 2026-07-30 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lut… |
CVE-2026-52680 | Critical | 9.8 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker w… |
CVE-2026-15382 | Medium | 6.5 | 2026-07-30 | The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploa… |
CVE-2026-67429 | Critical | 10.0 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlle… |
CVE-2026-56390 | | | 2026-07-29 | GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted witho… |
CVE-2026-57916 | | | 2026-07-27 | proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointi… |
CVE-2026-65896 | High | 7.1 | 2026-07-23 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. Pa… |
CVE-2026-14551 | High | 8.8 | 2026-07-22 | The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation… |
CVE-2026-47425 | | | 2026-07-21 | Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types… |
CVE-2026-15724 | High | 8.7 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerabil… |
CVE-2026-56452 | High | 7.5 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.
The implementation of… |
CVE-2026-58484 | High | 7.1 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` a… |
CVE-2026-45139 | Medium | 6.5 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','j… |
CVE-2026-50162 | | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir… |
CVE-2026-9587 | | | 2026-07-17 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled i… |
CVE-2026-44019 | High | 8.1 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling… |
CVE-2026-46336 | High | 7.1 | 2026-07-16 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0… |
CVE-2026-12979 | Medium | 5.5 | 2026-07-16 | The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing user… |
CVE-2026-15921 | Low | 3.1 | 2026-07-15 | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and… |
CVE-2026-50148 | Critical | 10.0 | 2026-07-15 | Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60… |
CVE-2026-61873 | High | 8.1 | 2026-07-15 | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversa… |
CVE-2026-8920 | | | 2026-07-15 | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to p… |
CVE-2026-50462 | High | 7.8 | 2026-07-14 | External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-55002 | High | 8.8 | 2026-07-14 | External control of file name or path in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-54108 | Medium | 6.5 | 2026-07-14 | External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-15736 | High | 8.3 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in mer… |
CVE-2026-57898 | Critical | 9.0 | 2026-07-14 | In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated… |
CVE-2026-61462 | High | 8.6 | 2026-07-13 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary… |
CVE-2026-13014 | | | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwri… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-14480 | Critical | 9.9 | 2026-07-10 | OpenPLC Runtime v3 contains an authenticated arbitrary file write
vulnerability in the legacy web UI program‑upload workflow. The
application stores an attac… |
CVE-2026-53449 | Medium | 6.0 | 2026-07-10 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argume… |
CVE-2026-59793 | High | 8.8 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration |
CVE-2026-58192 | High | 8.6 | 2026-07-08 | Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin ex… |
CVE-2026-59819 | Medium | 4.9 | 2026-07-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.10-stable, LiteLLM's /health/test_connection endpoint resol… |
CVE-2026-59807 | Medium | 6.8 | 2026-07-08 | Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting… |
CVE-2026-49145 | High | 7.5 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.
ack searches up the directory hierarchy from the current… |
CVE-2026-6101 | High | 7.5 | 2026-07-07 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to uns… |
CVE-2026-53648 | | | 2026-07-07 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic fi… |
CVE-2026-59196 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal ali… |
CVE-2026-59194 | High | 7.1 | 2026-07-06 | pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remov… |
CVE-2026-58293 | High | 8.1 | 2026-07-03 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-8921 | | | 2026-07-03 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampere… |
CVE-2026-5821 | High | 8.1 | 2026-07-02 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path valid… |
CVE-2026-55628 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is… |
CVE-2026-12480 | Medium | 5.5 | 2026-07-01 | Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides i… |
CVE-2026-6070 | Critical | 9.1 | 2026-07-01 | The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to in… |
CVE-2026-3602 | Medium | 4.7 | 2026-06-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable… |
CVE-2026-10816 | High | 7.5 | 2026-06-30 | Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is ena… |
CVE-2026-13748 | Medium | 6.3 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowfla… |
CVE-2026-8095 | High | 8.1 | 2026-06-28 | The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due… |
CVE-2026-47214 | High | 7.1 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backen… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71324 | High | 7.5 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/do… |
CVE-2026-55700 | High | 7.1 | 2026-06-25 | pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A… |
CVE-2026-55699 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious packa… |
CVE-2026-55477 | High | 7.2 | 2026-06-25 | 3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achi… |
CVE-2026-48720 | High | 8.8 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` paylo… |
CVE-2026-48520 | Medium | 6.1 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains… |
CVE-2026-53632 | | | 2026-06-22 | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths incl… |
CVE-2026-49358 | Low | 3.0 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public arr… |
CVE-2026-53915 | High | 7.1 | 2026-06-19 | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration |
CVE-2026-8118 | Medium | 6.5 | 2026-06-19 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary File Read in versions 1.7.1058 through… |
CVE-2026-11752 | | | 2026-06-19 | A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied… |
CVE-2025-52465 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows… |
CVE-2026-2604 | Medium | 5.6 | 2026-06-17 | A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craf… |
CVE-2026-10303 | High | 7.4 | 2026-06-16 | In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in cha… |
CVE-2026-39006 | Critical | 9.8 | 2026-06-15 | An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. |
CVE-2026-34030 | | | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch… |
CVE-2026-11527 | High | 8.6 | 2026-06-14 | Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle.
… |
CVE-2026-11526 | Critical | 9.8 | 2026-06-14 | GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.
GD::Image::_make_… |