Lucene search
+L

13169 matches found

NVD
NVD
added 2026/08/10 9:17 p.m.9 views

CVE-2026-72904

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in...

9.3CVSS0.00288EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/10 8:42 p.m.49 views

CVE-2026-72904

Firecrawl vulnerability CVE-2026-72904: Affected component is the extraction functionality. Before version 2.11.32, unsafe dereferencing of user-supplied JSON schemas via json-schema-ref-parser allows resolution of external/local file references during schema processing. An authenticated attacker...

9.3CVSS5.5AI score0.00288EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/10 8:42 p.m.8 views

CVE-2026-72904 Firecrawl: Arbitrary file read via JSON Schema $ref expansion

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to 2.11.32, a critical arbitrary file read vulnerability exists in Firecrawl's extraction functionality due to unsafe schema dereferencing of user-supplied JSON schemas in...

9.3CVSS5.6AI score
SaveExploits0References4
Chainguard
Chainguard
added 2026/08/10 8:30 p.m.14 views

CVE-2026-71850 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, kibana, langfuse, wazuh-dashboard, langfuse-fips...

4.8CVSS6.2AI score0.00164EPSS
SaveExploits0
NVD
NVD
added 2026/08/10 8:17 p.m.7 views

CVE-2026-69112

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

7.1CVSS0.00148EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/10 7:17 p.m.9 views

CVE-2026-71964

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

7.1CVSS0.00317EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/10 7:05 p.m.39 views

EUVD-2026-55743

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

7.1CVSS5.4AI score0.00148EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/10 7:05 p.m.9 views

CVE-2026-69112

Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in loadcheckpointinmodel and loadcheckpointanddispatch functions that fail to sanitize weightmap entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read...

7.1CVSS5.4AI score0.00148EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/10 6:51 p.m.27 views

CVE-2026-71964 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

7.1CVSS0.00317EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/10 6:51 p.m.8 views

CVE-2026-71964 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

7.1CVSS5.5AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/08/10 6:51 p.m.9 views

CVE-2026-71964

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

7.1CVSS5.4AI score0.00317EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/10 6:51 p.m.28 views

CVE-2026-71964

CVE-2026-71964 affects CyberPanel 2.4.3. A vulnerability in the file manager ZIP upload allows an authenticated attacker to read arbitrary system files by submitting a crafted ZIP with symbolic links. The root cause is the application's failure to validate symlinks before extraction, enabling sym...

7.1CVSS5.4AI score0.00317EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/10 6:51 p.m.11 views

EUVD-2026-55734

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...

7.1CVSS5.4AI score0.00317EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/10 3:26 p.m.61 views

CVE-2026-47754

CVE-2026-47754 affects Metacat 2.x (including 2.19.1) and all 1.x versions, with an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint. The bug stems from ArchiveHandler.readArchiveEntry() concatenating user input into a filesystem path and a disabled has...

9.3CVSS5.6AI score0.00338EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/10 12:07 p.m.34 views

CVE-2026-19429 Jenkins - FilePath.untarFrom() Symlink Target Validation Bypass and Blank-Name Check Bypass (Arbitrary File Read)

Jenkins FilePath.untarFrom does not validate symlink targets in extracted TAR archives, even in versions patched for CVE-2026-33001 and CVE-2026-70427. An authenticated attacker with job configuration privileges can include a malicious archive in a build step that creates workspace symlinks...

9.4CVSS6AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/10 12:07 p.m.21 views

CVE-2026-19429

...

5.2AI score0.00401EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/10 12:07 p.m.49 views

CVE-2026-19429

...

0.00401EPSS
SaveExploits0
OSV
OSV
added 2026/08/10 11:59 a.m.16 views

CVE-2026-72688 OpenSignLabs opensignserver - Missing Authentication for Critical Function

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...

7.5CVSS5.6AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/10 6:00 a.m.36 views

CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

0.00282EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/10 6:00 a.m.41 views

CVE-2026-17540

The CVE describes a vulnerability in the WordPress File Manager plugin prior to version 6.9.1. The issue is improper authorization of file management commands, allowing any authenticated user (e.g., a subscriber) to read and delete arbitrary files under the WordPress installation directory. This ...

8.8CVSS5.4AI score0.00282EPSS
SaveExploits0References1
Rows per page
Query Builder