CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...

CVE-2026-84882

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-17602

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

CVE-2026-78394 Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

Path Traversal

Apache Ant is vulnerable to a path traversal. The vulnerability is due to insufficient validation of relative paths provided by a remote server, which allows an attacker controlling or intercepting the server connection to write files outside the intended download directory and overwrite arbitrar...

OESA-2026-4052 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: A vulnerability in keras-team/keras versions = 3.15.0 allows for a denial of service DoS attack when loading malicious .keras model files via the keras.models.loadmodel function. The H5IOStore.getitem method in...

EUVD-2026-86481

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-84283

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-13456: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-84283: Insecure Storage of Sensitive Information

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Fold...

CVE-2026-17602: Improper Limitation of a Pathname to a Restricted Directory

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, t...

PT-2026-99020

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

PT-2026-98384

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description The plugin is subject to Directory Traversal, a flaw that allows an attacker to access files and directories that are stored outside the web root folder...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GStreamer Base Plugins vulnerability (USN-8797-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8797-1 advisory. It was discovered that GStreamer Base Plugins incorrectly handled certain OGG media files. A remote...

The vulnerability of the Application Performance Monitoring (APM) component of the Kibana data visualization service allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Application Performance Monitoring APM component of the Kibana data visualization service is related to the disclosure of information through registration files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protecte...

Debian dsa-6516 : ghostscript - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6516 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6516-1 [email protected] https://www.debian.org/security/...

Linux Distros Unpatched Vulnerability : CVE-2026-88372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader when parsing crafted MAT4 MATLAB v4 files. CVE-2026-88372 Note that Nessus relies ...

CVE-2026-93366: Authorization Bypass Through User-Controlled Key

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints...