PT-2026-81355

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A path sandbox bypass exists in corpus-reader constructors, enabling attackers to read files outside the intended data root. By supplying arbitrary corpus root paths to the LinThesaurusCorpusReader and...

CVE-2026-48441: Improper Limitation of a Pathname to a Restricted Directory

Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

PT-2026-70172

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

PT-2026-70827

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the file name form field with no path containment check. Attackers can register an...

PT-2026-70055

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description A flaw allows a remote attacker with 'deployer' account authentication to import and deploy a malicious archive file from an untrusted source. By leveraging WildFly libraries to create a...

PT-2026-70992

Name of the Vulnerable Software and Affected Versions Wazuh Manager affected versions not specified Description A deserialization of untrusted data issue exists in the Cluster DAPI Protocol, which allows a remote attacker to execute arbitrary code and perform arbitrary file read and write...

gitea -- Multiple vulnerabilities

Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...

Siemens License Server (SLS)

SUMMARY Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server SLS and recommends to update to the latest version. 2. GENERAL...

PT-2026-76027

The restoreTenant GraphQL mutation in Dgraph was missing from the admin mutation middleware configuration. This omission bypassed all authentication, IP whitelisting, and audit logging for this mutation. An unauthenticated remote attacker could use this mutation to trigger a database restore from...

PT-2026-70800

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

CVE-2026-73235: Improper Restriction of XML External Entity Reference

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the Xerces SAX2 XMLReader constructed in src/Base/Reader.cpp by Base::XMLReader::XMLReader parses attacker-controlled Document.xml from a crafted .FCStd archive without disabling default external entity...

CVE-2026-72713: Improper Limitation of a Pathname to a Restricted Directory

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the filename form field with no path containment check. Attackers can register an...

CVE-2026-72779: Incomplete List of Disallowed Inputs

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

PT-2026-70380

Name of the Vulnerable Software and Affected Versions CAI Content Credentials affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, known as Path Traversal, allows for arbitrary file system read. This issue enables an attacker to gain...

VulnCheck KEV: CVE-2016-20097

Weaver Fanwei E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, which is concatenated unsanitized into a SQL query. Attackers...

WordPress AI Engine path traversal vulnerability

WordPress AI Engine is a core component of the official WordPress plugin library developed by developer JordyMeow. Its purpose is to integrate multi-model AI capabilities chatbots, content generation, MCP smart agents, etc. natively into the WordPress backend, allowing for easy invocation of...

Planyo_Online_Reservation_System 3.0 - Arbitrary File Read via SSRF

Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisankar Vendor Homepage: https://www.planyo.com/wordpress-reservation-system/ Software Link: https://plugins.svn.wordpress.org/planyo-online-reservation-system/tags/2.9...

CVE-2026-24330: Unrestricted Upload of File with Dangerous Type

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

CVE-2026-72742: External Control of File Name or Path

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

PT-2026-80490

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS COOKIE SHA1 SASL authentication mechanism does not validate the cookie context parameter received from the server. A malicious D-Bus server can supply a cookie context containing path traversal sequences, causing the clien...