EUVD-2026-51401

ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...

CVE-2026-55495

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63222

CodeIgniter (PHP framework) has a path traversal vulnerability in UploadedFile::move() when the second argument is omitted, allowing an attacker to exploit client-provided filenames to write uploaded content outside the intended directory. This affects prior to version 4.7.4; a fix is available i...

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

EUVD-2026-51388

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495

Summary: Cloudreve up to v4.16.x is vulnerable to a path traversal via the WOPI PUT_RELATIVE handler. The WOPI header X-WOPI-SuggestedTarget is treated as a path and joined to the source directory using URI.JoinRaw, allowing slashes and dot-dot segments to escape the source file directory and cre...

SUSE CVE-2026-6815

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem,...

EUVD-2026-51336

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet...

EUVD-2026-51330

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)

The version of Adobe Bridge installed on the remote Windows host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code executi...

JFrog Artifactory < 7.111.18 / 7.117.x < 7.117.25 / 7.125.x < 7.125.18 / 7.133.x < 7.133.27 / 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

The vulnerability of the Grafana monitoring and surveillance platform lies in the improper restriction of the path name to the restricted access catalog, which allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Grafana monitoring and observation platform is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

VulnCheck KEV: CVE-2026-3836

A local, unprivileged attacker can exploit a path traversal flaw in the D-Bus locale configuration, crashing dnf5daemon-server via a crafted string. This can lead to a DoS with a core dump...

IBM Langflow OSS path traversal vulnerability

IBM Langflow OSS is an open-source low-code visual AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to integrate wit...

PT-2026-66678

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description An unauthenticated remote attacker can read image-decodable files and enumerate host paths. The get model preview function in app/model manager.py uses os.path.joinfolder, filename with an...