Pulse Connect Secure SSL VPN Arbitrary File Read

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...

EUVD-2026-72669

A vulnerability has been identified in SIMOVE Fleetmanager V3.1 All versions V3.1.13, SIMOVE Fleetmanager V3.2 All versions V3.2.4, SIMOVE Fleetmanager V3.3 All versions V3.3.2, SIMOVE Fleetmanager V4.0 All versions V4.0.1, SIPLANT V1.7 All versions, SIPLANT V2.2 All versions, SIPLANT V3.0 All...

SUSE CVE-2026-53474

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL...

EUVD-2026-71227

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

CVE-2026-85620: Incorrect Authorization

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

PT-2026-85544

Name of the Vulnerable Software and Affected Versions Postgres MCP Pro version 0.3.0 Description A restricted-mode bypass exists where function-name validation is not applied to RangeFunction nodes within FROM clauses. This allows attackers to bypass the allowlist and execute file-reading...

CVE-2026-82525: Improper Restriction of XML External Entity Reference

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

UBUNTU-CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-84270

A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...

CVE-2026-66671

An unauthenticated Local File Inclusion (LFI) vulnerability affects the WordPress plugin Verdure Core in versions

EUVD-2026-55235

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

EUVD-2026-54208

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

CVE-2026-3415

CVE-2026-3415 affects WSO2 products where the SchemaValidator Mediator processes XML input during validation. The XML parser may resolve external entities under certain crafted payloads, enabling an attacker with sufficient privileges to read files on the server and possibly cause outbound reques...

CVE-2026-3415 XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

UBUNTU-CVE-2026-19026

H5Zfilternbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cdvalues0 through cdvalues4 without validating that cdvalues is non-NULL or that cdnelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the...

JLSEC-2026-1065 ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability...

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...

CVE-2026-14522 IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters...

PT-2026-65908

Jinher OA C6 contains an XML External Entity XXE injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp manager getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack...

CVE-2026-65698

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...