CVE-2026-111230: External Control of File Name or Path

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

CVE-2026-110859 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-110859

GitPython versions prior to 3.2.0 are vulnerable to an argument injection vulnerability in the Head.checkout() function. A remote attacker can achieve arbitrary file read by providing a branch name that is parsed as a git option, such as --pathspec-from-file=. When a cloning application checks ou...

CVE-2026-110859 GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-100406

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-110775 Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

CVE-2026-110775 Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

Nexent through 2.7.0 contains a missing authorization vulnerability in checkfileaccess that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledgebase/ reads. Attackers in multi-tenant deployments can list objects via GET /file/storage f...

CVE-2026-110775

Nexent versions up to and including 2.7.0 are vulnerable to a missing authorization flaw within the check_file_access function. The root cause is the failure to perform tenant comparisons during knowledge_base/ reads, which allows authenticated users in multi-tenant environments to access data be...

CVE-2026-110767 Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion

Gitingest through 0.3.1 contains a symlink following vulnerability in ingestquery single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the serve...

CVE-2026-110767

The Gitingest tool, versions through 0.3.1 , is vulnerable to an arbitrary file read via a symlink following flaw in the ingest_query single-file blob ingestion component. An unauthenticated attacker can exploit this by submitting a blob URL pointing to a symlink committed in a public repository....

CVE-2026-110767 Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion

Gitingest through 0.3.1 contains a symlink following vulnerability in ingestquery single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the serve...

EUVD-2026-101567

Gitingest through 0.3.1 contains a symlink following vulnerability in ingestquery single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and submit its blob URL, causing the serve...

CVE-2026-100406 dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.r...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

EUVD-2026-101518

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

wazuh-unauth-chain

Wazuh exploit-chain PoC fixed in 4.14.8 — CVE-2026-74034 / C...

CVE-2026-107508: Improper Limitation of a Pathname to a Restricted Directory

The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file...

CVE-2026-77371: Improper Access Control

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: rsync (UTSA-2026-130076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130076 advisory. rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink...