CVE-2025-57231

Docmost versions 0.2.1 through 0.21.0 are vulnerable to a path traversal flaw caused by improper handling of avatar attachments. An unauthenticated attacker can exploit the /api/attachments/img/avatar endpoint via a POST request on a public URL by using %2F sequences to bypass path validation. Th...

PT-2026-89577

An XML External Entity XXE vulnerability exists in the XML collector of multiple versions of OpenNMS Meridian and Horizon. When OpenNMS collects XML from a source whose response is attacker-controlled for example a compromised monitored host or an HTTP man-in-the-middle position, the collector's...

PT-2026-89646

Name of the Vulnerable Software and Affected Versions Docmost versions 0.2.1 through 0.21.0 Description An unauthenticated actor can disclose local files through a path traversal issue caused by improper handling of avatar attachments. This is achieved by sending a POST request to a public URL...

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

CVE-2025-57231: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection through the high-level diff API in git/diff.py and git/repo/base.py. An attacker can turn repo.index.diff..., noindex=True into a blind...

EUVD-2026-69705

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...

GHSA-7833-FR7J-V32Q GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

HIGH Arbitrary local file content disclosure via include directive in untrusted .gitmodules SubmoduleConfigParser never disables mergeincludes - CWE: CWE-200 Exposure of Sensitive Information / CWE-73 External Control of File Name or Path - Affected component: git/objects/submodule/base.py,...

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

HIGH Arbitrary local file content disclosure via include directive in untrusted .gitmodules SubmoduleConfigParser never disables mergeincludes - CWE: CWE-200 Exposure of Sensitive Information / CWE-73 External Control of File Name or Path - Affected component: git/objects/submodule/base.py,...

CVE-2026-67367

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 All versions V3.1.13, SIMOVE Fleetmanager V3.2 All versions V3.2.4, SIMOVE Fleetmanager V3.3 All versions V3.3.2, SIMOVE Fleetmanager V4.0 All versions V4.0.1, SIPLANT V1.7 All versions, SIPLANT V2.2 All versions, SIPLANT V3.0 All...

CVE-2026-76958

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958 XML External Entity (XXE) Vulnerability in SAP Integration Suite

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the...

CVE-2026-76958

SAP Integration Suite contains an XML External Entity (XXE) vulnerability in certain internal components that do not sufficiently validate XML documents accepted from untrusted sources. An attacker with low privileges can submit crafted XML payloads containing malicious external entity declaratio...

PT-2026-87110

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-86538

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...

EUVD-2026-72125

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

CVE-2026-86258

nbviewer through version 1.0.1 is affected by a path traversal vulnerability in LocalFileHandler.can_show(). The root cause is the use of string-prefix comparison instead of proper path validation, allowing attackers to request paths that share the configured root as a textual prefix and thereby ...