16707 matches found
GHSA-F794-5JV7-7672 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
CVE-2026-85671
QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...
CVE-2026-85661
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...
CVE-2026-85688
TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...
CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...
CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...
CVE-2026-85661 excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...
CVE-2026-85661
excel-mcp-server 0.1.8 (by haris-musa) contains a path confinement bypass in stdio mode : when the EXCEL_FILES_PATH environment variable is unset, unchecked file paths supplied to the read and write tools allow an attacker to read and write arbitrary files accessible to the process. The vulnerabi...
CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...
EUVD-2026-71003
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...
PT-2026-85554
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...
CVE-2026-14470: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
CVE-2026-17621: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
CVE-2026-85580: Improper Limitation of a Pathname to a Restricted Directory
SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...
PT-2026-85574
Name of the Vulnerable Software and Affected Versions TEN Framework version 0.11.71 Description The TMAN Designer component contains flaws allowing unauthenticated users to read and write arbitrary files. By sending POST and PUT requests to the '/api/designer/v1/file-content' endpoint, an attacke...
PT-2026-85564
Name of the Vulnerable Software and Affected Versions QAnything version 2.0.0 Description An authentication bypass allows unauthenticated attackers to access any uploaded file or document. By enumerating file identifiers through unauthenticated endpoints, attackers can retrieve base64-encoded fil...
CVE-2026-85176
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
CVE-2026-85176
DbGate through 7.2.6 is vulnerable to arbitrary file read and write via the file:// scheme. The root cause lies in the jsldata controller , which fails to properly validate jslid parameters. An attacker can exploit the getJslFileName() function to bypass directory containment, allowing authentica...
EUVD-2026-70480
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...
