CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

a-blog cms vulnerable to path traversal

Overview a-blog cms provided by appleple inc. contains the following vulnerability. Path traversal CWE-22 - CVE-2026-87727 You are affected by this vulnerability only when "Attaching files to emails addressed to the administrator" is enabled in the form settings. hibiki moriyama of STNet,...

EUVD-2026-75889

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

EUVD-2026-75793

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-77807

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

CVE-2025-69904: Improper Limitation of a Pathname to a Restricted Directory

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

CVE-2026-87983: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-89259: Execution with Unnecessary Privileges

Hugo is a static site generator. From v0.161.0, Hugo executes Node tools under Node's permission model, but TailwindCSS — included in the default security.exec.allow list — requires a highly permissive configuration --allow-addons, --allow-child-process, --allow-worker. As a result, the...

CVE-2026-89242: Server-Side Request Forgery (SSRF)

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

PT-2026-89810

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

PT-2026-89845

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the json decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php ...

PT-2026-89899

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

PT-2026-89885

Name of the Vulnerable Software and Affected Versions Mistral Vibe versions 2.6.0 through 2.25.3 Description An arbitrary file read issue exists where an attacker can bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. This occurs due to improper handling o...

CVE-2025-69904

Linkstack version v4.8.4 and earlier is vulnerable to a Path Traversal flaw. This vulnerability allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation can result in unauthorized access to sensitive system or application files. No spe...

PT-2026-90016

Name of the Vulnerable Software and Affected Versions Linkstack versions prior to 4.8.5 Description Path Traversal allows an administrator to read arbitrary files on the server by manipulating file path input. This issue can lead to unauthorized access to sensitive system or application files...

CVE-2025-69904

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

EUVD-2025-210892

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

CVE-2026-81910: Improper Neutralization of Special Elements Used in a Template Engine

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2025-69904

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...

VulnCheck KEV: CVE-2026-85706

GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API...