cve-2020-10977

CVE-2020-10977 GitLab 12.9.0 Lectura Arbitraria de Archivos Objetivo : 12.9.0 e inferiores Probado : GitLab 12.8.1 En una reciente evaluación encontré una instancia de GitLab en el objetivo, encontré un PoC en Exploit-DB pero usa LDAP para autenticación y en este caso estaba deshabilitado, así qu...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

WordPress Divi Plus plugin <= 2.4.0 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by ShinThink in WordPress Plugin Divi Plus versions = 2.4.0...

WordPress SiteOrigin Widgets Bundle plugin <= 1.74.3 - Authenticated (Contributor+) Arbitrary File Read vulnerability

Authenticated Contributor+ Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SiteOrigin Widgets Bundle versions = 1.74.3...

WordPress Post Export Import with Media plugin <= 1.17.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin Post Export Import with Media versions = 1.17.1...

CVE-2026-108158

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

EUVD-2026-95906

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...

Security Bulletin: Security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in IBM WebSphere Application Server Liberty affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. IBM WebSphere Application Server Liberty is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak...

cve-2026-85706

cve-2026-85706 Unauthentifiziertes beliebiges lokales Dateilesen in GitLab CE/EE. Betrifft 18.7–19.1.7, 19.2.0–19.2.5, 19.3.0–19.3.1. Behoben in 19.1.8 / 19.2.6 / 19.3.2 2026-09-10. CVSS 10.0, Berichten zufolge in freier Wildbahn ausgenutzt. Ursprünglicher Bericht von s3ntago, und dieses Repo ist...

Arbitrary File Access

Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...

BIT-GHOST-2026-103276 Ghost before 6.20.0 File Read via URL Encoding Bypass

Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme templates and metadata. Attackers can use URL encoding to bypass extension validation and access sensitive theme files...

CVE-2026-101894

A flaw was found in the @xhmikosr/decompress and decompress packages for Node.js. The default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

VulnCheck KEV: CVE-2026-91136

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svgimage' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback SVGAnimatorController::indexpermission...

PT-2026-108977

Name of the Vulnerable Software and Affected Versions plugNmeet Server versions prior to 2.5.3 Description A path traversal issue exists in the whiteboard conversion endpoint. This allows any meeting participant to read server files by providing crafted filePath values using ../ sequences. This...

CVE-2026-21589: Critical Pre-Authentication File Read Affects Atlassian Data Center Products

Atlassian has released an out-of-band security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting a broad range of its Data Center products. The flaw carries a CVSS 4.0 score of 9.3 and can be exploited remotely without authentication or user interaction. Becaus...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Redhat Cloudforms

Ruby on Rails Sprockets Path Traversal CVE-2018-3760 Vulhu...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

ImageMagick PNG Text Chunk Arbitrary File Read CVE-2022-44268...

CVE_2021-41773

Vulnerability scanner for Apache Path Traversal CVEs 2021-41773...

Exploit for Path Traversal in Jenkins

Jenkins CLI Arbitrary File Read CVE-2024-23897 Vulhubhtt...

CVE-2026-1107

CVE-2026-1107 Nuclei Template Nuclei template for detecting CVE-2026-1107 in EyouCMS. The vulnerability allows unauthenticated attackers to perform Path Traversal/Arbitrary File Read via the checkuserinfo function in Diyajax.php. Vulnerability Details CVE ID: CVE-2026-1107 Target: EyouCMS 1.7.1...