CVE-2026-77270: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

Linux Distros Unpatched Vulnerability : CVE-2026-93712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the...

CVE-2026-61749

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

EUVD-2026-84053

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-94185

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

CVE-2026-94185 nvm alias resolution follows `..` and discloses files outside $NVM_DIR/alias

nvm resolves a requested version or alias by treating it as a filename under $NVMDIR/alias. Before 0.40.8, nvmalias concatenated the requested name onto that directory and read the result with no containment check, so a name containing a .. component escaped the alias directory; under the default...

PT-2026-96218

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description Privileged staff users with permissions to author report or label templates can trigger the WeasyPrint report rendering process to retrieve resources selected by an attacker via HTTP, HTTPS, or loc...

CVE-2026-61749: Exposure of Sensitive Information to an Unauthorized Actor

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

VulnCheck KEV: CVE-2018-13980

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal...

CVE-2026-94108

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94108 getID3 through 1.9.26 XML External Entity Injection via XML2array

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

CVE-2026-94108: Improper Restriction of XML External Entity Reference

getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on PHP before 8.0. Attackers can craft malicious XML metadata in media files to disclose local files, perform server-side request forgery, o...

Linux Distros Unpatched Vulnerability : CVE-2026-77281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and...

PT-2026-95959

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.27 Description An XML external entity injection issue exists in the XML2array helper function. The function fails to properly disable entity loading when running on PHP versions before 8.0. This allows attackers to...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-76902

CordysCRM is an open-source AI-powered CRM supporting private deployment. In versions prior to 1.7.4 , the ShiroFilter routes /attachment/preview/{id} and /pic/preview/{id} are configured as anonymous , and both call AttachmentService.getResource, which performs a bare primary-key lookup without ...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...