Files or Directories Accessible to External Parties

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the image tool when tools.fs.workspaceOnly is set to true but not enforced for mounted paths resolved by the sandbox file system...

EUVD-2026-9393

Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice Extension:NSFileRepo modules allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This...

MAL-2026-1161 Malicious code in xpack-sui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6569d492596cfa28e2627bd747ac4bd380bf9ff0e7ce0d931036e5f8de9ed276 The package xpack-sui was found to contain malicious code. Source: ghsa-malware 3fab32aa3396f63ec52f77a3d6ba319776c90390afa1264937a1537dde583443 Any...

CVE-2026-26069 Scraparr Readarr Integration exposes sensitive values as metric labels.

Scraparr is a Prometheus Exporter for various components of the arr Suite. From 3.0.0-beta to before 3.0.2, when the Readarr integration was enabled, the exporter exposed the configured Readarr API key as the alias metric label value. Users were affected only if all of the following conditions ar...

Malicious code in tor-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3281075aed24ae2af07fd17a56499318dcd8cd0fa836f60e1fa76814b90c2742 The package tor-libsignal was found to contain malicious code. Source: ghsa-malware 25164e8116dd5f0b085529d972fb628013ac35df2065ee934693a23bd13da788...

CVE-2023-4550

Improper Input Validation, Files or Directories Accessible to External Parties vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server on which it is hosted. Thi...

CVE-2025-40768

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V3.0. The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application...

CVE-2025-1540

An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2. It was possible for a user added as an External to read and clone internal projects under certain circumstances."...

PT-2026-1326

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.445 Description Coolify is a self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters from docker-compose.yaml files are not properly sanitized when...

CVE-2025-15065 Data Exposure in Kings Information & Network KESS Enterprise

Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerability in Kings Information & Network Co. KESS Enterprise on Windows allows Privilege Escalation, Modify Existing Service, Modify Shared...

MAL-2025-192661 Malicious code in adel-xnetgpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85b321aa51079c32d9640eb5619d6350f409dc14f26141a99a5744932ddee14 The package adel-xnetgpt was found to contain malicious code. Source: ghsa-malware 0ebdfb3056af9b8e58d8ce4bc938a77b985744ece2a3de14f4b691d2b97ca3ad A...

Malicious code in android_teminator_x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33c3191c5716cf98ab9a5976d22602d3140a131b7f906d2c51d88f60950e1a7a The package androidteminatorx was found to contain malicious code. Source: ghsa-malware...

Malicious code in tnactgfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc53eec6bc0141b35cd02a25f78b5c7862e6b8ed845eb0b47da084b5d3582396 The package tnactgfds was found to contain malicious code. Source: ghsa-malware 40a7fc6d425dcaf14cd401ae7c14ef495455f779891345d9844a6465c7d4f795 Any...

Files Or Directories Accessible To External Parties

Apache Kylin is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to improper access controls on certain files or directories, which allows an attacker to access resources that should be restricted if administrative access is not adequately protected...

CVE-2025-11959

Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse.This issue affects Excavation...

EUVD-2025-84341

Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information Technologies Inc. Excavation Management Information System allows Footprinting, Functionality Misuse.This issue affects Excavation...

PT-2025-46345

Name of the Vulnerable Software and Affected Versions Premierturk Information Technologies Inc. Excavation Management Information System versions prior to 10.2025.01 Description A condition exists that allows exposure of private personal information to an unauthorized actor and enables...

CVE-2025-64327

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. Versions 0.6.7 and below contain a Blind Server-Side Request Forgery SSRF vulnerability, in its /api/ping?url= endpoint. This allows an attacker to make arbitrary requests to internal or external hosts. This...

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the secure persistent volume feature. An attacker can access confidential data stored in persistent volumes by providing a crafted LUKS2 volume with a null key-encryption algorithm...