Directory Traversal

Overview @makafeli/n8n-workflow-builder is a Model Context Protocol server for n8n workflow management Affected versions of this package are vulnerable to Directory Traversal in the updatenodefromfile of server.cjs when handling the filePath argument. An attacker can access arbitrary files and...

File Inclusion fast-uri Dependency in Confluence Data Center

This High severity File Inclusion vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This File Inclusion vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows ...

EUVD-2026-42983

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary...

CVE-2026-55474 Snipe-IT: Directory traversal in displaySig

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary...

CVE-2026-59793

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration...

EUVD-2026-42911

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration...

CVE-2026-59793

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration...

CVE-2026-59793

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration...

CVE-2026-59793

CVE-2026-59793 affects JetBrains TeamCity prior to version 2026.1.2. The issue allows arbitrary file access via the Perforce VCS integration, due to the Perforce VCS integration component. Impact is described as high for confidentiality, integrity, and availability. The CVSS vector indicates netw...

CVE-2026-57961

phpMyFAQ قبل 4.1.5 contains an authenticated path traversal in Export/Pdf/Wrapper.php (concatenatePaths). An FAQ editor can inject HTML that includes crafted image paths; the code uses strpos() to locate the substring “content” in a user-controlled path, and if “content” is absent the result beco...

EUVD-2026-42856

R-SOFT DMS is vulnerable to Insecure Direct Object Reference IDOR attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This...

CVE-2026-41878

R-SOFT DMS is vulnerable to Insecure Direct Object Reference IDOR attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This...

CVE-2026-50180

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses...

PT-2026-57184

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration...

ROS-20260710-73-0031

The vulnerability of the Go programming language is related to the incorrect definition of the link before accessing a file. Exploiting this vulnerability can allow an attacker to increase their privileges...

Security Bulletin: Vulnerability in node-tar bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage

Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Content-Aware Storage include the node-tar library, which is susceptible to a Path Traversal vulnerability during archive extraction. When default configurations are used, an attacker-controlled archive can create a hardlink inside the extraction...

EUVD-2026-42748

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

Security Bulletin: Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files

Summary Two broken access control vulnerabilities in Langflow's file handling API allowed unauthorized access to user files. The first vulnerability CVE-TBD-1 in the GET /api/v1/files/images/flowid/filename endpoint lacked authentication requirements, allowing any unauthenticated attacker with...

CVE-2026-59212

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, verifyknowledgefileaccess only checked read access while file write and delete routes later trusted object-derived access through writable model meta.knowledge entries, allowing a user...

PYSEC-2026-2859 Paste Script has improper group memberships permissions

Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem...