CVE-2026-82193

The WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.134 is vulnerable to a Path Traversal flaw. The application fails to validate user-supplied filenames when constructing a write path, which allows users with administrator privileges to write files of permitted types...

CVE-2026-82193 WPvivid Backup & Migration < 0.9.134 - Admin+ File Write Outside the Backup Directory via Path Traversal

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

EUVD-2026-70910

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

PT-2026-85587

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when...

CVE-2026-75168

The MBS-Solutions X-Serie Gateway (firmware V6_00_05 ) is vulnerable to an issue in the ugw-editfile method of the /cgi-bin/wwwugw.cgi component. This flaw allows a remote authenticated user with a low-privileged Standard role to write arbitrary content to files located within the /uxx/config/ an...

PT-2026-85503

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.10.55 Description A path traversal issue exists in the admin plugin's Save As action due to improper validation of the language code parameter. An authenticated admin user with admin.pages.create permission can use...

PT-2026-85421

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files...

CVE-2026-75168

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

CVE-2026-75168

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

PT-2026-85683

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

PT-2026-85570

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

PT-2026-85588

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...

EUVD-2026-71445

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

PT-2026-85550

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git log, git diff, and git show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

PT-2026-85576

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc ...

CVE-2026-50553: Improper Input Validation

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-85661: Improper Limitation of a Pathname to a Restricted Directory

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85626: Improper Neutralization of Argument Delimiters in a Command

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-9138: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled input without sufficient sanitization when...

CVE-2026-85688: Missing Authentication for Critical Function

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...