CVE-2026-11974

The wp-media-folder-addon WordPress plugin versions before 4.1.7 is vulnerable to Arbitrary File Disclosure and Server-Side Request Forgery (SSRF) . The root cause is the failure to validate a user-supplied parameter used in a file read operation within two AJAX actions accessible to unauthentica...

CVE-2026-18085

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

CVE-2026-18085 Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

CVE-2026-18085

The vulnerability CVE-2026-18085 affects BlackBerry UEM, specifically the Management Console in BlackBerry UEM 12.23.0 QF8 and earlier. It is caused by improper input validation in the affected console, allowing Arbitrary File Download and potentially Denial of Service. Documents do not provide e...

CVE-2026-18085

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

EUVD-2026-49897

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

CVE-2026-18085 Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

EUVD-2026-49876

Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can...

PT-2026-65531

Name of the Vulnerable Software and Affected Versions BlackBerry UEM versions prior to 12.23.0 QF9 Description Improper input validation in the BlackBerry UEM Management Console allows for arbitrary file download and potential denial of service. This occurs when the system fails to properly verif...

CVE-2026-18085: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service...

CVE-2026-16870: Stack-based Buffer Overflow

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

CVE-2026-65919

Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without path validation. Attackers can supply absolute paths or traversal sequences in...

PT-2026-64044

Name of the Vulnerable Software and Affected Versions Meshery versions prior to 1.0.57 Description An unauthenticated arbitrary file read issue exists in the '/api/system/fileView' and '/api/system/fileDownload' endpoints. The system passes user-supplied file parameters directly to the os.Open...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

PT-2026-61709

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594: Improper Limitation of a Pathname to a Restricted Directory

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

WordPress Under Construction plugin <= 5.76 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by Nguyen Ngoc Duc duc193 in WordPress Plugin Under Construction versions = 5.76...

SUSE SLES15 Security Update : python-urllib3 (SUSE-SU-2026:2854-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2854-2 advisory. This update for python-urllib3 fixes the following issue - Regression introduced by CVE-2025-66471 fix during file download with pySSL...

CVE-2026-53536 Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret but did not check the token's audience, and combined with a missing null-check on the decoded fileId, this allow...