CVE-2026-70200

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70009

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70200

Azure Logic Apps is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to elevate privileges over a network. The CNA-assigned CVSS 3.1 score is 10.0 (Critical) , reflecting a network-based attack with low c...

CVE-2026-70009

Azure Arc is affected by a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory. An unauthenticated attacker can exploit this over the network to elevate privileges , achieving high integrity impact with low confidentiality impact and no availability ...

CVE-2026-54670

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

CVE-2026-54613

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54520

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54612

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54343

Frappe Learning Management System LMS is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a traversal path handled by SCORMRenderer.render in lms/pagerenderers.py. The renderer constructs and opens a server-side path without first...

CVE-2026-54520

AI Agent Automation (vmDeshpande/ai-agent-automation), a modular AI agent workflow automation platform, is affected by a path traversal vulnerability (CWE-22) in the file-step implementation of backend/src/agents/executor.js. Prior to v0.9.1 , the user-controlled step.path value is resolved via p...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

EUVD-2026-82577

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

CVE-2026-54520 AI Agent Automation: Workflow file step path traversal allows read and write outside the expected directory

AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step implementation in backend/src/agents/executor.js passes the user-controlled step.path value through path.resolve with process.cwd and then us...

EUVD-2026-82574

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

EUVD-2026-82570

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54612

Vvveb (a CMS with page builder) versions 1.0.0 through 1.0.8.5 are affected by an authenticated path traversal to arbitrary PHP file write in saveGlobalElements() (admin/controller/editor/global-trait.php). The attacker-controlled file portion of data-v-save-global is concatenated to the active t...

CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...