CVE-2026-19059 FoundationAgents MetaGPT editor.py read path traversal

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

R7-Officer document editor Arbitrary JavaScript Execution

The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to execute arbitrary JavaScript code...

CVE-2026-27436

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

CVE-2026-27436

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

EUVD-2026-41338

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

PT-2026-54982

Editor Arbitrary Code Execution in Five Star Business Profile and Schema = 2.3.19 versions...

CVE-2026-53632 NTLMv2 hash disclosure via UNC path handling on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

Microsoft Excel Disclosure

The vulnerability of Microsoft Excel spreadsheet editors within the Microsoft Office and Microsoft 365 Apps for Enterprise software packages is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow attackers to disclose sensitive information that is protecte...

Microsoft Visual Studio Code Path Traversal

The vulnerability of Microsoft Visual Studio Code’s editor is related to incorrect path name restrictions for the directory. Exploiting this vulnerability could allow an attacker to bypass existing security restrictions...

Microsoft Visual Studio Code Editor Disclosure

The vulnerability of Microsoft Visual Studio Code’s editor is related to insufficient protection for service data. Exploiting this vulnerability can allow a malicious actor to disclose protected information remotely...

Adobe Dreamweaver Authentication Bypass Info Disclosure

The vulnerability of the Adobe Dreamweaver HTML editor is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to read arbitrary files...

Microsoft Visual Studio Code Editor Path Traversal

The vulnerability of Microsoft Visual Studio Code’s editor is related to errors in handling relative pathnames to directories. Exploiting this vulnerability can allow an attacker to gain read and modify access to data remotely...

Adobe Dreamweaver Auth Bypass RCE

The vulnerability of the Adobe Dreamweaver HTML editor is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2026-39465

Editor Remote Code Execution RCE in Responsive Slider by MetaSlider = 3.106.0 versions...

WordPress MW WP Form plugin <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting vulnerability

Authenticated Editor+ Stored Cross-Site Scripting vulnerability discovered by Sérgio Charruadas itzvenom in WordPress Plugin MW WP Form versions = 5.1.3...

EUVD-2024-55605

launch-editor vulnerable to command injection via the crafted request on Windows...

CVE-2026-47742

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor Edit, Inventory, Seo, Shipping, Files had no authorization on their store method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO...

PT-2026-44943

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0 Description Sub-form Livewire components within the product editor—specifically those handling Edit, Inventory, Seo, Shipping, and Files—lack authorization on their store method. This allows any authenticated...

RockyLinux 10 : vim (RLSA-2026:19073)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19073 advisory. vim: arbitrary command execution via modeline sandbox bypass CVE-2026-34982 Tenable has extracted the preceding description block directly from the RockyLinux...