GHSA-68MJ-5WR7-6FGG vulnerabilities

Vulnerabilities for packages: conductor, zipkin, druid, cassandra-reaper, thingsboard, conductor-fips, nuxeo, traccar-fips, traccar...

logto-tunnel serves files outside --experience-path via path traversal

Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...

CVE-2026-63188

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-75593

Prior to BuildKit 0.31.2, a client with control API access can craft an upload request causing files to escape the BuildKit state directory, enabling directory traversal. Fixed in v0.31.2. No exploitation details provided; CVSS 7.2 HIGH (network, low complexity, low privileges required).

CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

GHSA-WF6J-GR27-G7CH GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

GHSA-RR55-JP92-8WP2 claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

GHSA-CC2G-GQ8C-R332 grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools

Summary Several grok-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

CVE-2026-32475

Elementor Pro WordPress plugin (≈6,000,000 active installations) is vulnerable to unauthenticated arbitrary file upload in all versions up to and including 4.2.1 . The root cause is a logic error in the Upload::validation() function where return is used instead of continue when the first array el...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

CVE-2026-32475 WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...

WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Tin Pham aka TF1T in WordPress Plugin Elementor Pro versions = 4.2.1...

CVE-2026-53803

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation. Mitigati...

CVE-2026-49441

Wazuh versions 4.3.0 through 4.14.6 and 5.0.0-beta3 are affected by an arbitrary file write vulnerability in the cluster master component. The non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json...

EUVD-2026-62571

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...