CVE-2026-65702

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...

CVE-2026-65701

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audiopath field o...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65920

Diffusers up to 0.39.0 is affected by a path traversal in the _get_checkpoint_shard_files function. Attackers can supply malicious weight_map values in the model index JSON (e.g., ../ sequences or absolute paths) to escape the model directory and read safetensors files outside the intended locati...

CVE-2026-65920 Diffusers Path Traversal via weight_map Arbitrary File Read

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the getcheckpointshardfiles function that allows attackers to read arbitrary files by supplying malicious weightmap values in model index JSON. Attackers can use ../ sequences or absolute paths in...

CVE-2026-65919 Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65919

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

CVE-2026-65698

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

CVE-2026-65695

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...

CVE-2026-65696

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

CVE-2026-65702

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...

CVE-2026-65702 Vanna 2.0.2 Path Traversal via FileSystemConversationStore

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...

CVE-2026-65701

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audiopath field o...

CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-65700

CVE-2026-65700 affects h2oGPT 0.2.1 via the OpenAI-compatible files API. The vulnerability arises from a path traversal weakness in get_user_dir where the bearer token is unsafely used as a path component with os.path.join, allowing unauthenticated remote attackers to read, write, and delete file...

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

Security Bulletin: Multiple vulnerabilities in IBM Desktop App

Summary Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0. Vulnerability Details CVEID:CVE-2026-11980 DESCRIPTION: IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up. CWE:CWE-242: Use of Inherently Dangerous Function CVSS Source: IBM...