CVE-2026-105037 | Critical | 9.9 | 2026-10-15 | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server b… |
CVE-2026-111234 | Medium | 5.9 | 2026-10-15 | SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects… |
CVE-2026-111230 | Medium | 4.9 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by sett… |
CVE-2026-57155 | Critical | 9.9 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths… |
CVE-2026-54703 | | | 2026-10-14 | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in Markdown Preview En… |
CVE-2026-92153 | High | 7.1 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink ha… |
CVE-2026-107594 | Critical | 10.0 | 2026-10-14 | The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the… |
CVE-2026-110385 | | | 2026-10-14 | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbox-compatible JWT to… |
CVE-2026-69783 | High | 7.8 | 2026-10-13 | External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. |
CVE-2026-106042 | Critical | 9.9 | 2026-10-13 | An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application… |
CVE-2026-103928 | | | 2026-10-13 | Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions aga… |
CVE-2026-109601 | Medium | 6.5 | 2026-10-12 | Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. At… |
CVE-2026-59976 | High | 8.1 | 2026-10-12 | ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convert_to parameter to construct an output… |
CVE-2026-93695 | High | 7.4 | 2026-10-12 | In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path w… |
CVE-2026-108694 | Medium | 6.5 | 2026-10-11 | ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts inv… |
CVE-2026-108591 | Medium | 4.4 | 2026-10-10 | InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abu… |
CVE-2026-108156 | High | 7.1 | 2026-10-09 | LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDi… |
CVE-2026-107377 | High | 7.5 | 2026-10-08 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply abso… |
CVE-2026-87685 | Medium | 6.8 | 2026-10-08 | An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a… |
CVE-2026-106559 | Medium | 6.3 | 2026-10-07 | Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package… |
CVE-2026-106494 | Medium | 4.4 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validatio… |
CVE-2026-79814 | Medium | 6.7 | 2026-10-06 | An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow malicious users on a local instance to elevate their user privi… |
CVE-2026-106109 | | | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved… |
CVE-2026-106103 | High | 7.1 | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile comman… |
CVE-2026-106219 | Medium | 6.5 | 2026-10-06 | In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server |
CVE-2026-105865 | High | 8.1 | 2026-10-06 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated us… |
CVE-2026-105748 | Medium | 4.3 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the I… |
CVE-2026-105744 | High | 7.5 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, calle… |
CVE-2026-105676 | Medium | 4.9 | 2026-10-05 | Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Adm… |
CVE-2026-86671 | | | 2026-10-05 | In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher… |
CVE-2026-104809 | | | 2026-10-05 | DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legiti… |
CVE-2026-104805 | | | 2026-10-05 | DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to… |
CVE-2026-103511 | | | 2026-10-05 | Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token… |
CVE-2026-103507 | | | 2026-10-05 | Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authenti… |
CVE-2026-104853 | | | 2026-10-02 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migration… |
CVE-2026-71453 | | | 2026-10-01 | - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.
This issue affects EasyIO FS32: before 3.0b63. |
CVE-2026-97662 | High | 8.2 | 2026-10-01 | An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to cre… |
CVE-2026-103255 | Critical | 9.0 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tab… |
CVE-2026-15983 | High | 8.1 | 2026-10-01 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.31… |
CVE-2026-19253 | High | 8.7 | 2026-10-01 | The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not co… |
CVE-2026-101148 | Critical | 10.0 | 2026-10-01 | The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, w… |
CVE-2026-103591 | High | 7.5 | 2026-09-30 | DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter… |
CVE-2026-102146 | Medium | 6.5 | 2026-09-30 | An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbit… |
CVE-2026-102141 | Medium | 6.7 | 2026-09-30 | Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write… |
CVE-2026-103398 | High | 8.1 | 2026-09-30 | OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary director… |
CVE-2026-10739 | | | 2026-09-30 | Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-sup… |
CVE-2026-10726 | | | 2026-09-30 | Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, r… |
CVE-2026-91072 | Medium | 4.4 | 2026-09-30 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, l… |
CVE-2026-101126 | Medium | 6.5 | 2026-09-29 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checki… |
CVE-2026-85520 | | | 2026-09-29 | Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated a… |
CVE-2026-54675 | | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionali… |
CVE-2026-100638 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitra… |
CVE-2026-100637 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files… |
CVE-2026-13248 | High | 8.8 | 2026-09-24 | An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in… |
CVE-2026-96656 | High | 7.2 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appen… |
CVE-2026-92164 | Medium | 6.5 | 2026-09-23 | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file… |
CVE-2026-91797 | High | 7.8 | 2026-09-23 | Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be writte… |
CVE-2026-77247 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpre… |
CVE-2026-83603 | High | 8.4 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsu… |
CVE-2026-77621 | | | 2026-09-22 | Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the re… |
CVE-2026-65125 | Medium | 6.6 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit… |
CVE-2026-61647 | | | 2026-09-21 | NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1… |
CVE-2026-53940 | High | 8.8 | 2026-09-21 | Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in co… |
CVE-2026-54584 | | | 2026-09-21 | mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid… |
CVE-2026-94401 | | | 2026-09-21 | MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importi… |
CVE-2026-90817 | Critical | 9.8 | 2026-09-20 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user… |
CVE-2026-93987 | Low | 3.4 | 2026-09-19 | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume… |
CVE-2026-19860 | Medium | 5.5 | 2026-09-19 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom fie… |
CVE-2026-6205 | High | 8.1 | 2026-09-18 | An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4… |
CVE-2026-50158 | High | 7.7 | 2026-09-17 | yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parame… |
CVE-2026-55062 | | | 2026-09-17 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated h… |
CVE-2026-54583 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filename… |
CVE-2026-54582 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed… |
CVE-2026-92595 | Medium | 5.9 | 2026-09-16 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte… |
CVE-2026-63225 | Medium | 4.4 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths unde… |
CVE-2026-73171 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmw… |
CVE-2026-76553 | Medium | 6.5 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directo… |
CVE-2026-76796 | Medium | 4.0 | 2026-09-15 | The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowi… |
CVE-2026-73496 | High | 7.7 | 2026-09-14 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and conf… |
CVE-2026-54629 | High | 7.5 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-16338 | Critical | 9.9 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper valida… |
CVE-2026-90946 | High | 7.5 | 2026-09-14 | DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as… |
CVE-2026-90932 | High | 7.2 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService… |
CVE-2026-77006 | Critical | 9.6 | 2026-09-12 | The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, a… |
CVE-2026-77005 | Critical | 9.6 | 2026-09-12 | The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capabilit… |
CVE-2026-49836 | | | 2026-09-10 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a pa… |
CVE-2026-88899 | Critical | 9.8 | 2026-09-10 | knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can suppl… |
CVE-2026-53956 | Medium | 5.4 | 2026-09-09 | Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to versi… |
CVE-2026-86751 | High | 8.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue se… |
CVE-2026-86741 | High | 8.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege… |
CVE-2026-87815 | High | 8.7 | 2026-09-09 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An a… |
CVE-2026-79692 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Pat… |
CVE-2026-53581 | Critical | 9.0 | 2026-09-08 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal v… |
CVE-2026-86995 | Medium | 4.3 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, b… |
CVE-2026-78620 | Medium | 5.9 | 2026-09-08 | The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the… |
CVE-2026-66302 | Critical | 9.8 | 2026-09-08 | External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69383 | High | 7.0 | 2026-09-08 | External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-69355 | High | 8.8 | 2026-09-08 | External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |