CVE-2026-86016

VNote, a note-taking platform, contains a Stored XSS vulnerability in versions prior to 4.3.0 . The root cause is located in src/data/extra/web/js/markdownit.js, where the application assigns p_metaData to preNode.innerHTML before the protectFromXss sanitization path executes. This allows an atta...

CVE-2026-86016 VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = pmetaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can...

CVE-2026-86016 VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration

VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment preNode.innerHTML = pmetaData in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can...

CVE-2026-54640

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-88834

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limite...

CVE-2026-106047

Ivanti Xtraction versions prior to 2026.4 are vulnerable to a Path Traversal vulnerability within the template export functionality . This flaw allows a remote authenticated attacker to perform arbitrary file reads. The documents do not provide specific details regarding exploit availability or d...

CVE-2026-103928

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-54640

The OpenRemote IoT platform is vulnerable to an XML External Entity (XXE) injection in the KNXProtocol.startAssetImport() method. This occurs because the KNXProtocol handler, located in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java, processes user-uploaded ETS project ZIP...

CVE-2026-54640 OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

CVE-2026-103928

The business intelligence platform Metabase is vulnerable to arbitrary file read and write in versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4. The root cause is the failure to restrict host-facing built-in functions when processing native queries or actions against an H2 data source ...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

CVE-2026-74034

Wazuh versions 4.1.0 before 4.14.8 are vulnerable to an arbitrary file read vulnerability due to a missing origin check in the wm_agent_upgrade component. This flaw allows enrolled agents to issue upgrade_custom commands using an attacker-controlled file_path . An attacker can inject an upgrade_c...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

EUVD-2026-98164

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

EUVD-2026-98157

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-53564: Improper Limitation of a Pathname to a Restricted Directory

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-106616: Improper Restriction of XML External Entity Reference

ColdFusion is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issu...

PT-2026-113546

Name of the Vulnerable Software and Affected Versions Citrix UniconOS versions prior to 2607.2 CR Citrix UniconOS versions prior to 2603 LTSR CU2 Description An issue in Citrix UniconOS allows for arbitrary file read and write operations, enabling an attacker to access or modify files on the syst...

VulnCheck KEV: CVE-2025-10897

The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read...