CVE-2026-66635 WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855

ArcadeDB versions before 26.8.1 do not sanitize database names in the POST /api/v1/server endpoint, allowing authenticated root users to supply ../ sequences for arbitrary file creation or recursive directory deletion. CVSS 8.7 HIGH; exploitation details not provided. Remediation is to upgrade to...

WordPress Slider by 10Web plugin <= 1.2.62 - CSRF to Arbitrary File Deletion vulnerability

CSRF to Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Slider by 10Web versions = 1.2.62...

SUSE CVE-2026-53789

rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic...

SUSE CVE-2026-53800

rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file between transfer completion and the unlink...

PT-2026-78233

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8 Description An authenticated project manager can use traversal sequences in the filename parameter of the 'GET /exports/:id/:filename' endpoint. In the server/api/controllers/boards/download.js file, the...

PT-2026-77251

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...

EUVD-2026-60396

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

SUSE-SU-2026:3634-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under 'use chroot = no' bsc1269042. - CVE-2026-53785: --relative implied-parent...

ANT-2026-QXNF2N9K · rocketchat · Authentication-bypass

auth-bypass high CVE-2026-48929 Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-QXNF2N9K: Unauthenticated Arbitrary Fil...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

CVE-2026-74798

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

CVE-2026-74798 SiYuan kernel Path Traversal via database_clean MCP tool

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

EUVD-2026-60081

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the databaseclean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView kernel/model/attributeview.go, which builds a filesystem path via filepath.Join withou...

CVE-2026-74798

SiYuan kernel versions before v3.7.4 contain a path traversal vulnerability in the database_clean MCP tool . The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepat...

WordPress RapiSafe plugin <= 1.0.4 - Unauthenticated Arbitrary File Deletion via 'rsmfcf7_session' and 'file_name' Parameters vulnerability

Unauthenticated Arbitrary File Deletion via 'rsmfcf7session' and 'filename' Parameters vulnerability discovered by Spy0x7 in WordPress Plugin RapiSafe – Secure Multi File Upload for Contact Form 7 versions = 1.0.4...

PT-2026-76888

Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.0.4 Description Terragrunt contains a flaw that allows arbitrary file deletion when downloading external modules. The issue occurs during the directory cleanup process within the fileManifest.Clean function locat...