14233 matches found
CVE-2026-109304
Craft CMS versions 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 are vulnerable to an arbitrary file read vulnerability. The root cause is that the Twig create() class blocklist fails to include DOMDocument , allowing attackers to bypass restrictions. By setting an entry-type title format (e.g., v...
Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provid
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
SUSE-SU-2026:4628-1 Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the...
CVE-2026-109601: External Control of File Name or Path
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...
PT-2026-110721
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create'DOMDocument'.loadHTMLFile...
PT-2026-110726
SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a kernel plugin handler's ResponseFile.Path to gin's Context.File without validation. Attackers supplying a malicious kernel plugin can return an absolute path to...
EulerOS 2.0 SP13 : perl-Archive-Tar (EulerOS-SA-2026-4082)
According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...
CVE-2026-109304: Exposure of Sensitive Information to an Unauthorized Actor
Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create class blocklist does not cover DOMDocument. Attackers able to set an entry-type title format, including via project-config/apply, can use create'DOMDocument'.loadHTMLFile...
EulerOS 2.0 SP13 : perl-Archive-Tar (EulerOS-SA-2026-4173)
According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...
CVE-2026-19627: Improper Limitation of a Pathname to a Restricted Directory
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths...
wpgarlic
wpgarlic Un fuzzer de plugins de WordPress como prueba de concepto que llevó al descubrimiento de más de 300 vulnerabilidades en plugins de WordPress instalados en casi 30 millones de sitios. La técnica utilizada se describe en https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html Si deseas...
CVE-2026-108694
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
CVE-2026-108694
ConvertX versions through 0.19.0 are vulnerable to an arbitrary file read vulnerability. The root cause is located in src/converters/pandoc.ts, where the application invokes Pandoc without the --sandbox flag. This allows authenticated users to upload a reStructuredText document containing an incl...
CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
CVE-2026-108694
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
EUVD-2026-96697
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
CVE-2026-108694 ConvertX through 0.19.0 Arbitrary File Read via Pandoc Converter
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
PT-2026-109988
Name of the Vulnerable Software and Affected Versions ConvertX versions prior to 0.19.1 Description Authenticated users can read server files because the src/converters/pandoc.ts file invokes Pandoc without the --sandbox flag. An attacker can exploit this by uploading a reStructuredText document...
CVE-2026-108694: External Control of File Name or Path
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server files because src/converters/pandoc.ts invokes Pandoc without the --sandbox flag. Attackers can upload a reStructuredText document with an include directive naming an absolute path...
CVE-2023-40028
CVE-2023-40028 Exploit This script exploits a vulnerability in Ghost CMS, allowing arbitrary file read through symbolic link abuse. Features Creates a symlink to the target file Compresses the payload into a ZIP file Uploads the ZIP file via the Ghost API Reads the file through an accessible imag...