CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886

Notepad++ versions before 8.9.7 use std::wstring::starts_with to validate the backupFilePath attribute in session.xml during snapshot-mode restoration without path normalization, allowing .. sequences to read arbitrary user-readable files outside the backup directory into an editor tab. CVSS 5.1 ...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

EUVD-2026-60374

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-52886 Notepad++: session.xml backupFilePath starts_with Bypass

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::startswith against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667

ApostropheCMS versions before 3.6.2 are vulnerable to arbitrary file read via path traversal in the import-export module. The file packages/import-export/lib/formats/gzip.js builds an attachment source path using attacker-controlled _id, name, and extension fields from aposAttachments.json withou...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-12553

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

EUVD-2026-60324

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553

HP Web Jetadmin (WJA) is vulnerable to DLL hijacking, allowing unauthenticated remote attackers to read or write arbitrary files. CVSS 4.0 scores this CRITICAL (9.3) with network access, low complexity, and no privileges required. Exploitation is rated PROOF-OF-CONCEPT. Details: https://support.h...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

GHSA-M6JG-WR9M-CG2F uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

Summary Path Traversal vulnerability in hook filename handling allows attackers to access and manipulate arbitrary files outside the hooks directory via directory escape sequences like passwd. Details File: hooks.go Lines 135-160 hookFileName := args0 // User input not validated hookFile =...