GO-2026-6368 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList

OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList...

GO-2026-6439 Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost

Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost...

GO-2026-6373 SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure in github.com/siyuan-note/siyuan/kernel...

GO-2026-6411 MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox

MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints in github.com/googleapis/mcp-toolbox...

GO-2026-6350 Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db in github.com/siyuan-note/siyuan/kernel

Siyuan: Authenticated path traversal in /snippets/ static handler serveSnippets leaks conf/conf.json secrets and siyuan.db in github.com/siyuan-note/siyuan/kernel...

GO-2026-6365 SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) in github.com/siyuan-note/siyuan/kernel

SiYuan: path traversal via /export/temp/ short-circuit branch incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f in github.com/siyuan-note/siyuan/kernel...

EUVD-2026-75510

importcontacts Path Traversal in Groundhogg = 4.7.1 versions...

CVE-2026-85310 WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

importcontacts Path Traversal in Groundhogg = 4.7.1 versions...

CVE-2026-85310

A Path Traversal vulnerability exists in the import_contacts function of the Groundhogg WordPress plugin, affecting versions ≤ 4.7.1 . The CVSS 3.1 score is 6.5 (Medium) , indicating a network-attack vector with low complexity, low privileges required, and a high impact on confidentiality but no ...

CVE-2026-85310 WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

importcontacts Path Traversal in Groundhogg = 4.7.1 versions...

CVE-2026-88790

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...

CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

EUVD-2026-75507

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...

CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...

CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...

CVE-2026-88790

proma-ai Proma versions up to 0.19.37 contain a path traversal vulnerability in the File Preview Service component, specifically in the resolveTargetPath function within apps/electron/src/main/lib/file-preview-service.ts. The root cause is a basename-collision fallback that allows an attacker to ...

CVE-2026-88790 proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the component File Preview Service. Such manipulation of the argument filepath leads to path traversal. Local...

EUVD-2026-75455

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...