CVE-2026-20310: Improper Link Resolution Before File Access

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

PT-2026-68251

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN affected versions not specified Description An issue exists involving improper link resolution before file access. This occurs when the system does not correctly validate symbolic links or shortcuts before accessing the...

PT-2026-68024

Name of the Vulnerable Software and Affected Versions The-Pocket/PocketFlow affected versions not specified Description The pocketflow-coding-agent cookbook example implements a pathworkdir, p helper function that acts as a simple wrapper for os.path.joinworkdir, p without performing...

PT-2026-68248

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN affected versions not specified Description An issue exists involving improper link resolution before file access. This occurs when the system does not properly validate symbolic links or shortcuts before accessing the...

PT-2026-68328

Name of the Vulnerable Software and Affected Versions rclone versions 1.40.0 through 1.74.0 Description The serve restic command fails to properly reject URL paths starting with ../ in the WithRemote function within cmd/serve/restic/restic.go. This allows a leading parent path to be passed to GET...

PT-2026-68120

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions 2.3 and later Description URL handling in the DefaultFaceletFactory function does not properly sanitize or block remote URLs. This allows an attacker to specify a URL to a remote Facelet, which the server then includes...

CVE-2026-55747: Improper Limitation of a Pathname to a Restricted Directory

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...

Linux Distros Unpatched Vulnerability : CVE-2026-71235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua scri...

Grav CMS isSafeDynamicCall File Access

The vulnerability of the Blueprint::isSafeDynamicCall method in the Grav CMS system is related to improper code generation management. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read, create, and copy files and directories...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux (versions 0.0–26.02) is affected by a path traversal vulnerability (CWE-22) in the Triton MLflow plugin . An authenticated local user can supply a crafted path in the model name to read, write, or modify files outside the model repository, potentially lead...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

CVE-2026-47487

NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...

NPM: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

NPM: Flowise: Missing authorization on /api/v1/files allows low-privileged API keys to list and delete files across workspaces within the same organization vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

GHSA-WP74-F5HH-5F3R Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

summary: In Flowise, the /api/v1/files route is protected only by the feat:files feature gate and does not enforce checkPermission... on either GET or DELETE. As a result, any authenticated API key within the organization, even one with unrelated permissions, can list and delete files belonging t...

PYSEC-2026-3588 Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

Summary Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds...

Security Bulletin:lxml Local File Access Vulnerability: Fixed in 6.1.0

Summary lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration with resolveentities=True allows untrusted XML input to read local files. Setting the resolveentities option explicitly to...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin, in versions prior to 2.2.0 , is vulnerable to an authentication bypass. The plugin fails to perform proper authorization checks on several file-management AJAX actions that are accessible to unauthenticated users. This flaw allows an unauthentica...

CVE-2026-15958 Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...