CVE-2024-1561

CVE-2024-1561 - Gradio 임의 파일 읽기 CVE-2024-1561 은 4.13.0 이전 Gradio 버전에 영향을 주는 임의 파일 읽기 취약점입니다. Gradio는 머신러닝 모델과 AI 애플리케이션용 웹 인터페이스를 빠르게 구축하는 데 사용되는 널리 알려진 Python 프레임워크입니다. 이 취약점은 /componentserver 엔드포인트가 내부 Component 클래스의 어떤 메서드를 호출할 수 있는지 제대로 제한하지 않기 때문에 발생합니다. 공격자는 이 동작을 악용하여 HTTP로 노출될 의도가 없는 메서드를...

PT-2026-102958

Name of the Vulnerable Software and Affected Versions wgagent affected versions not specified Description A missing authorization issue in the session initialization function of the wgagent management daemon allows an authenticated user with low privileges, such as a guest or read-only...

SUSE CVE-2026-93537

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

UBUNTU-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 are vulnerable to a path traversal vulnerability within the files view. The root cause is the improper validation of the path parameter before it is passed to the output_file function. This allows authenticated users with Events view permission to read arb...

CVE-2026-55156

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

EUVD-2026-88398

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

CVE-2026-101894

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2010-4231-EXPLOIT

CVE-2010-4231 - Directory Traversal Vulnerability in Camtron and TecVoz IP Cameras CVE-2010-4231 is a directory traversal vulnerability that exists in the web-based administration interface of the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera. The vulnerability allows...

EUVD-2026-88365

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2008-5862-EXPLOIT

CVE-2008-5862 - webcamXP 5.3.2.375 和 5.3.2.410 中的目录遍历漏洞 此仓库包含 CVE-2008-5862 的利用代码，该安全漏洞存在于 webcamXP 5.3.2.375 和 5.3.2.410 build 2132 版本中。该利用代码利用目录遍历缺陷，使远程攻击者能够未经授权访问任意文件并读取其内容。 漏洞描述 CVE-2008-5862 是一个严重的安全漏洞，攻击者可通过操纵 URI 执行目录遍历攻击。通过使用编码的点-点-斜杠序列（%2F），远程攻击者可以绕过访问控制并从目标系统获取敏感信息。 利用详情 该利用代码利用...

CVE-2026-81375

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

EUVD-2026-88214

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...

CVE-2026-100750 Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

CVE-2026-100750 Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected module. This feature is enabled by default in affected versions. The overrides are applied...

Exploit for Path Traversal in Gitlab

CVE-2026-85706 GitLab unauthenticated arbitrary file read ★ C...

CVE-2026-55156: Improper Limitation of a Pathname to a Restricted Directory

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

Important: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...