CVE-2026-21137: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

CVE-2026-108938: Files or Directories Accessible to External Parties

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used...

PT-2026-111010

Name of the Vulnerable Software and Affected Versions Matrimonial System version 1.0 Description A flaw in the processing of the db/matrimony.sql file allows remote attackers to gain unauthorized access to files or directories. Recommendations At the moment, there is no information about a newer...

EUVD-2026-95627

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...

path-auditor

PathAuditor PathAuditor es una herramienta diseñada para encontrar vulnerabilidades relacionadas con el acceso a archivos mediante la auditoría de funciones de libc. La idea es aproximadamente la siguiente: Auditar cada llamada a funciones libc relacionadas con el sistema de archivos realizada po...

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

Red Lion Controls N-Tron 700 Series - Update A

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow a malicious user to access the device and gain administrative access. This access would allow the user to view, edit, and upload configuration files. Further, a malicious user can cause the switch to reboot by...

CVE-2026-107608: Improper Link Resolution Before File Access

Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset. To remediate this issue, users should upgrade to version 2.267.0 or...

PT-2026-108714

Name of the Vulnerable Software and Affected Versions PraisonAI Agents affected versions not specified Description The Subprocess Sandbox backend fails to enforce security policies defined in the SecurityPolicy data class. Although the strict method is intended to create a restrictive environment...

Symlink Attack

Overview @backstage/plugin-scaffolder-backend-module-bitbucket-cloud is a The Bitbucket Cloud module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...

Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

EUVD-2026-94052

Backstage: Inconsistent enforcement of allowed location types during catalog processing...

GHSA-PCMQ-25R3-5W9V Backstage: Inconsistent enforcement of allowed location types during catalog processing

Impact Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host. Patches Patched in @backstage/plugin-catalog-backend version 3.9.1 Workarounds No practical workarounds ar...

CVE-2026-106496

A flaw was found in the Backstage plugin-catalog-backend component. Due to inconsistent enforcement of allowed location types during catalog processing, an authenticated remote attacker can submit location targets that should be restricted under specific configurations. This flaw can enable the...

GHSA-83RP-Q473-J88C Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Impact An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. Vulnerable versions This vulnerability is present in Ghost from v6.14.0 up to v6.27.0. Patches v6.27.0 contains a fix for this issue. How to update For...

Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Impact An input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. Vulnerable versions This vulnerability is present in Ghost from v6.14.0 up to v6.27.0. Patches v6.27.0 contains a fix for this issue. How to update For...

Cisco Application Policy Infrastructure Controller Unauthorized File Access Vulnerability

A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, remote attacker to access sensitive files on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. Th...

CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

Overview On October 5, 2026, Atlassian published a security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting eight products: Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crow...

Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details

Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 CVSS score: 9.3 affects multiple products, including...

EUVD-2026-94221

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the UR...