42543 matches found
CVE-2026-44594
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
CVE-2026-44594 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
CVE-2026-44594
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
CVE-2026-44594 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
EUVD-2026-32911
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
CVE-2026-44594 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...
CVE-2026-45017
CVE-2026-45017 affects the Python Liquid engine. Before 2.2.0, FileSystemLoader and CachingFileSystemLoader fail to guard against reading files outside the search path when given absolute paths, enabling a malicious template author to load and render arbitrary files via {% include %} and {% rende...
BIT-JOOMLA-2026-40383 Joomla! Core - [20260509] - LFI in HTMLView layout parameter
An improper validation of user-supplied input leads to a local file inclusion vulnerability...
PT-2026-45982
Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and CachingFileSystemLoader do not guard against reading files outside their search paths when given an absolute path to resolve. This allows malicious template authors to load and...
Atlassian Jira Service Management Data Center and Server 5.15.2 < 10.3.18 / 10.4.0 < 11.3.5 (JSDSERVER-16578)
The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16578 advisory. - This File Inclusion vulnerability allows an unauthenticated attacker to get the application to displ...
CVE-2026-48972
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5...
WordPress Truemag theme <= 4.3.14.2 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by JoĆ£o Pedro S AlcĆ¢ntara Kinorth in WordPress Theme Truemag versions = 4.3.14.2...
WordPress Roneous theme <= 2.1.5 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by JoĆ£o Pedro S AlcĆ¢ntara Kinorth in WordPress Theme Roneous versions = 2.1.5...
WordPress ITactics theme <= 1.0 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme ITactics versions = 1.0...
WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Line Agency versions = 1.3.1...
WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Etude versions = 1.6...
WordPress Tipsy theme <= 1.1 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Tipsy versions = 1.1...
WordPress Resurs theme <= 1.3 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Resurs versions = 1.3...