CVE-2026-59816 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass t...

CVE-2026-59816 Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, the GET /api/transcribe/:id and POST /api/transcribe/:id handlers in packages/server/src/routes/api/transcribe.ts on Joplin Server instances with TRANSCRIBEENABLED=true pass t...

CVE-2026-49453

Joplin (open-source note-taking app) contains a path traversal in its resource synchronization mechanism prior to versions 3.6.15 and 3.7.2 . The root cause is that synchronized resource metadata fields (id or file_extension) are stored unvalidated by BaseItem.unserialize(), then concatenated int...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

EUVD-2026-84167

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

CVE-2026-52835

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

UBUNTU-CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-52835

Tautulli , a Python-based monitoring and tracking tool for Plex Media Server, is affected by a path traversal / arbitrary file write vulnerability prior to version 2.17.2 . The flaw exists in the import_config handler and the database_file branch of import_database in plexpy/webserve.py, where an...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

EUVD-2026-84067

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-62369

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destinatio...

CVE-2026-63416

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

CVE-2026-62369

KubeEdge's keadm component contains a path traversal vulnerability in the DecompressTarGz function located in keadm/cmd/keadm/app/cmd/util/common.go. The root cause is the lack of sufficient validation when joining archive entry names to the extraction destination. This specifically affects Windo...

CVE-2026-62369 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destinatio...