CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability (CVE-2026-28321) that could allow arbitrary file read and write, enabling privilege escalation and code execution as root. A domain administrator access is required, and impact is lower on Windows installations. The provided c...

CVE-2026-13693

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

CVE-2026-13693

The CVE describes a path-traversal in the Bit Form WordPress plugin (affected: before 3.1.0) where a form file-field value is not restricted to a safe path before reading and attaching to a notification email, allowing unauthenticated attackers to read arbitrary server files (e.g., WordPress conf...

PT-2026-63293

Name of the Vulnerable Software and Affected Versions Gitea versions 1.22.x and earlier Description A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The DownloadURL field in release attachments is passed to the uri.Open...

CVE-2026-47144 Shamefile has an arbitrary file read via shamefile.yaml in shame next

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See...

CVE-2026-53594

Summary: CVE-2026-53594 affects FreeScout (PHP/Laravel) where the App Logs viewer can read arbitrary server files due to a flawed path resolution in the rap2hpoutre/laravel-log-viewer override. Before v1.8.224, the code accepts any existing absolute path prior to applying the storage/logs restric...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-27823

A vulnerability has been identified in EGroupware that may lead to Remote Code Execution RCE. The issue allows an authenticated attacker to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The...

CVE-2026-54910

FileBrowser Quantum is vulnerable to a path traversal flaw in the subtitlesHandler endpoint (GET /api/media/subtitles) prior to v1.4.3-beta. The vulnerability arises from two user-controlled parameters, path and name, used in filesystem operations without sanitization. The path parameter is passe...

CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-63739

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file...

CVE-2026-63739 SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file...

EUVD-2026-45910

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file...

CVE-2026-63739

SurrealDB contains an arbitrary file read vulnerability prior to 3.1.5 in the DEFINE ANALYZER mapper filter. This allows users with EDITOR or OWNER roles to read files accessible to the SurrealDB process by specifying arbitrary file paths in the mapper filter and retrieving contents via query err...

CVE-2026-63739 SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZER

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file...

CVE-2026-63739

SurrealDB before 3.1.5 contains an arbitrary file read vulnerability in the DEFINE ANALYZER mapper filter that allows database users with EDITOR or OWNER roles to read files accessible to the SurrealDB process. Attackers can specify arbitrary file paths in the mapper filter and retrieve file...

PT-2026-61555

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5 Description An arbitrary file read issue exists in the DEFINE ANALYZER mapper filter. Database users with EDITOR or OWNER roles can read files accessible to the SurrealDB process by specifying arbitrary file...

VulnCheck KEV: CVE-2026-29059

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's getlogfile endpoint "/api/w/workspace/jobsu/getlogfile/filename". The filename parameter is...