PT-2026-132217

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their...

PT-2026-132495

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without checking containment. When a reused...

Jenkins 2.441 Arbitrary File Read

Jenkins version 2.441 and earlier contains an arbitrary file read vulnerability in CLI argument expansion. The included proof of concept demonstrates unauthenticated disclosure through the Jenkins CLI. https://packetstorm.news/download/238176...

Apache Camel 4.22.1 Docling Output Path Traversal

Apache Camel version 4.22.1 camel-docling passes the CamelDoclingOutputFilePath header directly to Docling's output-directory option, allowing conversion output to be written to an attacker-selected writable directory. The supplied proof of concept demonstrates the issue in Spring Boot and Quarku...

Apple iOS 27.0.1 CoreMedia File Descriptor Leak

Apple iOS version 26.5 through 27.0.1 CoreMedia contains a permissions issue that allows a sandboxed app to obtain file descriptors for media-library files via the mediaplaybackd bytestream XPC service. The proof of concept demonstrates read access, directory enumeration, and a file-existence...

CVE-2026-107347: HashiCorp: HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log…

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the clien...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and prior to 2025.0.4. These vulnerabilities stem from a path traversal issue, which may allow the delegated host administrator to access or modify files outside their authorized scope...

CVE-2026-107053

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

EUVD-2026-113260

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

PT-2026-132376

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

Progress Software WS_FTP Server authorization issue vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.7 and 2025.0.4 contain an authorization issue vulnerability stemming from improper authentication in the Web Transfer Module. This vulnerability may allow attackers possessing the user’s password to access certain files associated with that...

Frappe path traversal vulnerability

Versions prior to Frappe 15.121.0 and versions 16.x prior to 16.34.0 contain a path traversal vulnerability. This vulnerability arises because file upload processing fails to validate target paths before writing them to disk. As a result, authenticated attackers may upload specially crafted files...

CVE-2026-113692: BMC BMC IT Service Management Suite: Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and…

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory...

CVE-2026-115245: Unknown Chat AI with Dispatcher: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…

The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote code execution...

PT-2026-132832

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions 3.0.0 through 3.3.6 MariaDB Connector/J versions 3.4.0 through 3.4.4 MariaDB Connector/J versions 3.5.0 through 3.5.10 Description The validateLocalFileName function in ClientMessage uses a regular expression that...

PT-2026-132716

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 and 0.8.0 Description A directory traversal issue exists in the use example file function. A remote attacker can exploit this to write files outside the intended workspace or storage boundary, potentially overwriting or...

ROS-20261029-73-0012

The File System Access component vulnerability in Google Chrome and Microsoft Edge web browsers is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain access to sensitive data and compromise data integrity via a specially crafted PDF file...

VulnCheck KEV: CVE-2026-104995

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajaxtemplate' value parsed from the client-controlled 'bpsdirectory' cookie during BuddyPress AJAX directory requests. The bpsdirectoryajax filter hooked onto...

PT-2026-130648

Name of the Vulnerable Software and Affected Versions Chat AI with Dispatcher versions prior to 2.4 Description An issue exists where uploaded files are not properly validated, as the system relies solely on a spoofable client-supplied content type. This allows unauthenticated attackers to upload...

PT-2026-132100

Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker...