CVE-2026-105772

A Path Traversal (CWE-22) vulnerability exists in the FileArtifactService of Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 . A remote unauthenticated attacker can use crafted relative or percent-encoded path traversal sequences (e.g., ../ or ..%2F) in the userId or sessionId par...

CVE-2026-105772 Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId

Path Traversal CWE-22 in FileArtifactService in Google ADK TypeScript @google/adk versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files when an agent tool invokes saveArtifact outside the intended artifact storage...

CVE-2026-112948

Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI,...

CVE-2026-112950

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

CVE-2026-112950

The Vitest testing framework (versions 4.1.11 to 4.1.12 and 5.0.3) is vulnerable to a path traversal flaw on Windows systems. The root cause is an inconsistency in how isFileLoadingAllowed and filesystem read operations interpret backslashes within packages/mocker/src/node/interceptorPlugin.ts. A...

CVE-2026-112950

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...

CVE-2026-97400

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-97400

In Eclipse OpenJ9 versions up to 0.63 , the jdmpview tool (or equivalent DTFJ code) is vulnerable to an XML External Entity (XXE) injection within the XMLIndexReader component. An attacker can cause the analyst's machine to read arbitrary local files specified within a supplied diagnostic dump bu...

EUVD-2026-105014

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-113354

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

CVE-2026-113354

Versions of Dockhand prior to 1.0.46 are vulnerable to an arbitrary file read vulnerability via the /api/system/files/content endpoint. This issue stems from incorrect authorization (CWE-863), allowing non-admin users possessing stacks:edit permissions to access files by supplying absolute paths....

CVE-2026-113354 Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

EUVD-2026-104925

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

CVE-2026-43851

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...

CVE-2026-43851

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system...

CVE-2026-43851

A path traversal vulnerability exists that could allow an authenticated attacker to read arbitrary files on the system. Technical details regarding the specific affected software, version, or root cause are not provided in the documents. No exploit information or remediation steps are available.