PT-2026-132124

Name of the Vulnerable Software and Affected Versions Agno versions prior to 3.1.12 Description An unsafe reflection issue exists in PandasTools where model-controlled function names are passed to the getattr function. This allows an attacker to use prompt injection to invoke arbitrary pandas...

PT-2026-130645

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...

PT-2026-132414

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.7.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, Kustomize passes ref or version query values from remote resource, base, or component URLs to git fetch without an end-of-options separator. A leading-hyphen value can be...

CVE-2026-66089: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves…

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations SSRF...

CVE-2026-51863: n/a: DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file…

DB-GPT v0.7.5 and 0.8.0 contains directory traversal in useexamplefile packages/dbgpt-app/src/dbgptapp/openapi/apiv1/examplesapi.py:129. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-61645: docat-org docat: Docat is a tool for hosting versioned static documentation

Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the Upload API arises because the API does not validate the uploaded file path or type. An attacker can overwrite sensitive configuration files or place malicious...

PT-2026-132820

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.6.0 through 4.6.2 Description A client with TCP access to an exposed development server can send a nuxt:dev:client-error event over the HMR Hot Module Replacement socket. By including an absolute file path at the end of the...

CVE-2026-84294: Progress Software WS_FTP Server: Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to…

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

CVE-2026-77819: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-97860: Yamaha Corporation: YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths

YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges...

CVE-2026-113617: Unknown Automated Import Products to Cart: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files including ones containing the database credentials and...

CVE-2026-119210: mariadb-corporation mariadb-connector-j: MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the ClientMessage.validateLocalFileName check used a regular expression that could match LOAD DATA LOCAL INFILE text inside quoted identifiers, string...

Rapid7 Insight Agent command injection vulnerability

Versions prior to Rapid7 Insight Agent 4.1.4.43 contain a command injection vulnerability. This vulnerability stems from improper handling of local file system paths, potentially allowing authenticated local users to gain elevated privileges...

Ghost Commander File Manager security vulnerability

Version 479 of Ghost Commander File Manager contains a security vulnerability stemming from improper permission settings. This vulnerability may allow unauthorized attackers to read and write files in the Commander’s private storage at will...

docat-org docat arbitrary file upload vulnerability

Docat-org: Versions prior to 1.6.0 of Docat contain an arbitrary file upload vulnerability. This vulnerability arises because the Upload API fails to validate the path or type of uploaded files, potentially allowing unauthorized file uploads. Such uploads may overwrite sensitive configuration fil...

CVE-2026-107018

Ghost Commander File Manager versionCode 479 is affected by a security vulnerability caused by improper permission settings . This flaw allows unauthorized attackers to arbitrarily read and write files within the application's private storage. No specific remediation information or exploit links ...

ISAACS node-glob resource management error vulnerability

Versions of isaacs node-glob from 9.0.0 up to and including 14.0.2 contain a resource management error vulnerability. This vulnerability arises because callbacks within the file traversal abort branch fail to return; after an AbortSignal is rejected or reported as an error, recursion continues...

CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…

Improper authentication in the Web Transfer Module of Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements...

CVE-2026-51912: n/a: OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in…

OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-uploadfile-the-preserved-live-upload-file-witness-directly-reaches ToolServer/ToolServerNode/main.py:46...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4. These vulnerabilities stem from improper restrictions on pathnames used for restricted directories, potentially allowing unauthenticated attackers to access files outside the intended directo...