CVE-2026-103591 | High | 7.5 | 2026-09-30 | DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repo_url parameter… |
CVE-2026-102146 | Medium | 6.5 | 2026-09-30 | An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbit… |
CVE-2026-102141 | Medium | 6.7 | 2026-09-30 | Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding root on one node of a cluster could write… |
CVE-2026-103398 | High | 8.1 | 2026-09-30 | OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary director… |
CVE-2026-10739 | | | 2026-09-30 | Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-sup… |
CVE-2026-10726 | | | 2026-09-30 | Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, r… |
CVE-2026-91072 | Medium | 4.4 | 2026-09-30 | The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, l… |
CVE-2026-101126 | | | 2026-09-29 | Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4 - The final form submission processes JSON arrays per upload field, checki… |
CVE-2026-85520 | | | 2026-09-29 | Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. An unauthenticated a… |
CVE-2026-54675 | | | 2026-09-28 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionali… |
CVE-2026-100638 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitra… |
CVE-2026-100637 | High | 7.6 | 2026-09-26 | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files… |
CVE-2026-13248 | High | 8.8 | 2026-09-24 | An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in… |
CVE-2026-96656 | High | 7.2 | 2026-09-23 | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appen… |
CVE-2026-92164 | Medium | 6.5 | 2026-09-23 | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file… |
CVE-2026-91797 | High | 7.8 | 2026-09-23 | Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be writte… |
CVE-2026-77247 | Medium | 6.5 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpre… |
CVE-2026-83603 | High | 8.4 | 2026-09-22 | Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsu… |
CVE-2026-77621 | | | 2026-09-22 | Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the re… |
CVE-2026-65125 | Medium | 6.6 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit… |
CVE-2026-61647 | | | 2026-09-21 | NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1… |
CVE-2026-53940 | High | 8.8 | 2026-09-21 | Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_entry_point_def in co… |
CVE-2026-54584 | | | 2026-09-21 | mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid… |
CVE-2026-94401 | | | 2026-09-21 | MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network services.
When importi… |
CVE-2026-90817 | Critical | 9.8 | 2026-09-20 | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user… |
CVE-2026-93987 | Low | 3.4 | 2026-09-19 | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume… |
CVE-2026-19860 | Medium | 5.5 | 2026-09-19 | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom fie… |
CVE-2026-6205 | High | 8.1 | 2026-09-18 | An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4… |
CVE-2026-50158 | High | 7.7 | 2026-09-17 | yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parame… |
CVE-2026-55062 | | | 2026-09-17 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated h… |
CVE-2026-54583 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filename… |
CVE-2026-54582 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed… |
CVE-2026-92595 | Medium | 5.9 | 2026-09-16 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message conte… |
CVE-2026-63225 | Medium | 4.4 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths unde… |
CVE-2026-73171 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS in firmw… |
CVE-2026-76553 | Medium | 6.5 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directo… |
CVE-2026-76796 | Medium | 4.0 | 2026-09-15 | The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowi… |
CVE-2026-73496 | High | 7.7 | 2026-09-14 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and conf… |
CVE-2026-54629 | High | 7.5 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-16338 | Critical | 9.9 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper valida… |
CVE-2026-90946 | High | 7.5 | 2026-09-14 | DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo_url as… |
CVE-2026-90932 | High | 7.2 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService… |
CVE-2026-77006 | Critical | 9.6 | 2026-09-12 | The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, a… |
CVE-2026-77005 | Critical | 9.6 | 2026-09-12 | The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capabilit… |
CVE-2026-49836 | | | 2026-09-10 | psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a pa… |
CVE-2026-88899 | Critical | 9.8 | 2026-09-10 | knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can suppl… |
CVE-2026-53956 | Medium | 5.4 | 2026-09-09 | Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to versi… |
CVE-2026-86751 | High | 8.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue se… |
CVE-2026-86741 | High | 8.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege… |
CVE-2026-87815 | High | 8.7 | 2026-09-09 | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An a… |
CVE-2026-79692 | High | 7.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Pat… |
CVE-2026-53581 | Critical | 9.0 | 2026-09-08 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal v… |
CVE-2026-86995 | Medium | 4.3 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, b… |
CVE-2026-78620 | Medium | 5.9 | 2026-09-08 | The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the… |
CVE-2026-66302 | Critical | 9.8 | 2026-09-08 | External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69383 | High | 7.0 | 2026-09-08 | External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-69355 | High | 8.8 | 2026-09-08 | External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. |
CVE-2026-62804 | High | 7.8 | 2026-09-08 | External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-81830 | | | 2026-09-07 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via i… |
CVE-2026-86189 | Critical | 9.8 | 2026-09-05 | WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by su… |
CVE-2026-79426 | High | 7.2 | 2026-09-04 | An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary fil… |
CVE-2026-80119 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vu… |
CVE-2026-80118 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical… |
CVE-2026-85687 | High | 7.5 | 2026-09-04 | surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file_path… |
CVE-2026-85684 | Critical | 9.1 | 2026-09-04 | marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthen… |
CVE-2026-85668 | High | 7.5 | 2026-09-04 | Xinference (affected commit 4a94832, v3.x) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint… |
CVE-2026-85603 | Medium | 6.5 | 2026-09-04 | Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An… |
CVE-2026-82194 | Medium | 5.5 | 2026-09-04 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, al… |
CVE-2026-81347 | Medium | 5.9 | 2026-09-04 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it… |
CVE-2026-75602 | Medium | 6.5 | 2026-09-03 | OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool… |
CVE-2026-85176 | High | 8.8 | 2026-09-03 | DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resoluti… |
CVE-2026-85160 | High | 8.1 | 2026-09-03 | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete director… |
CVE-2026-84478 | High | 7.3 | 2026-09-01 | WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files… |
CVE-2026-84374 | High | 7.5 | 2026-09-01 | Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy… |
CVE-2026-73770 | High | 7.3 | 2026-09-01 | An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific cond… |
CVE-2026-73720 | High | 7.2 | 2026-09-01 | Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful… |
CVE-2026-73719 | High | 7.2 | 2026-09-01 | An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate priv… |
CVE-2026-82393 | High | 7.5 | 2026-08-31 | pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm… |
CVE-2026-53508 | | | 2026-08-31 | oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did n… |
CVE-2026-82659 | High | 7.1 | 2026-08-31 | nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbit… |
CVE-2026-82637 | Medium | 5.3 | 2026-08-30 | browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrar… |
CVE-2026-66324 | Medium | 6.5 | 2026-08-28 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-19084 | High | 7.5 | 2026-08-28 | The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers… |
CVE-2026-12513 | Medium | 6.8 | 2026-08-28 | The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend fi… |
CVE-2026-53580 | High | 8.1 | 2026-08-27 | Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a no… |
CVE-2026-81726 | High | 7.0 | 2026-08-27 | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-contr… |
CVE-2026-79653 | | | 2026-08-27 | In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.stor… |
CVE-2026-77016 | Critical | 9.6 | 2026-08-27 | The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain t… |
CVE-2026-59683 | Critical | 9.8 | 2026-08-26 | The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a f… |
CVE-2026-59682 | Critical | 9.1 | 2026-08-26 | Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3. |
CVE-2026-16444 | High | 7.5 | 2026-08-26 | Improper
neutralization of path traversal sequences in TeamViewer Desktop Clients prior
Version 15.81.5 allows an authenticated remote session participant to w… |
CVE-2026-77693 | High | 8.7 | 2026-08-26 | The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which pa… |
CVE-2026-62865 | | | 2026-08-25 | Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of lo… |
CVE-2026-55609 | High | 7.1 | 2026-08-25 | sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1… |
CVE-2026-19913 | High | 7.5 | 2026-08-25 | The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedL… |
CVE-2026-79674 | High | 8.2 | 2026-08-25 | NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended… |
CVE-2026-55527 | High | 7.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller su… |
CVE-2026-77139 | | | 2026-08-25 | The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An auth… |