PT-2026-82038

Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve...

PT-2026-81852

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp download of the file src/transcribe anything/ytldp download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely...

PT-2026-81904

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...

CVE-2026-79792: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...

Cloudreve's remote download file paths can escape the selected destination directory

Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as ../../escaped.txt can cause a downloaded file to be created outside the user-selected destination directory. Details In the remote download master transfer path, Cloudreve joins th...

GHSA-W8J7-39HP-8X59 Cloudreve's remote download file paths can escape the selected destination directory

Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as ../../escaped.txt can cause a downloaded file to be created outside the user-selected destination directory. Details In the remote download master transfer path, Cloudreve joins th...

GHSA-F78G-9385-QXQJ Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-77914

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-66906

The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) because the downloadBlobToFile operation fails to perform lexical normalization or boundary checks on remote blob names. When downloading blobs to the directory specified by the fileDir opti...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-28167

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

EUVD-2026-64796

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167

CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...

WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...