CVE-2017-20284: Improper Limitation of a Pathname to a Restricted Directory

Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...

CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-88623: Files or Directories Accessible to External Parties

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-28199: Improper Verification of Cryptographic Signature

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

CVE-2026-13684: Improper Encoding or Escaping of Output

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13673: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-16777: Improper Limitation of a Pathname to a Restricted Directory

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-14323: Improper Limitation of a Pathname to a Restricted Directory

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

CVE-2026-93468: Relative Path Traversal

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files...

EUVD-2026-82974

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

PT-2026-95227

Name of the Vulnerable Software and Affected Versions OAKlouds affected versions not specified Description An Arbitrary File Read issue exists in OAKlouds developed by HGiga. Unauthenticated remote attackers can use Relative Path Traversal—a technique used to access files and directories stored...

PT-2026-95314

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

PT-2026-95316

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95312

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-12 Synology DiskStation Manager versions prior to 7.2.2-72806-9 Synology DiskStation Manager versions prior to 7.3.2-86009-4 Synology DiskStation Manager versions prior to 7.4-90075...

Linux Distros Unpatched Vulnerability : CVE-2026-92595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer npm package nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is...

EulerOS Virtualization 2.12.1 : perl-Archive-Tar (EulerOS-SA-2026-3604)

According to the versions of the perl-Archive-Tar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction...

EulerOS 2.0 SP10 : perl-Archive-Tar (EulerOS-SA-2026-3757)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-88623

The NUUO Network Video Recorder 2.0.0 is vulnerable to an arbitrary file read flaw located in the up.php component. The issue occurs because the application accepts a user-supplied url parameter via POST and uses the fopen() function to open the URL in binary read-only mode. The resulting content...