EUVD-2026-62186

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...

CVE-2026-48796 CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...

CVE-2026-73973

Linuxfabrik Monitoring Plugins (for Icinga/Nagios) prior to 7.0.0 is vulnerable to arbitrary root file disclosure via the check-plugins/logfile/logfile plugin. The --filename parameter accepts a free-form path that is opened as root through the shipped sudoers allowlist, with no confinement to /v...

CVE-2026-73973 Linuxfabrik Monitoring Plugins: Arbitrary root file disclosure via unconfined --filename in logfile plugin (sudoers LPE)

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 7.0.0, check-plugins/logfile/logfile accepted a free-form --filename path and opened it as root when invoked through the shipped nagios or icinga sudoers allowlist, without confini...

CVE-2026-63642

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:08+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g...

CVE-2026-69160

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

EUVD-2026-61101

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...

@rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

GHSA-2MF3-MR2R-R4VF @rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

CVE-2026-75912 CodeWhale before 0.8.64 Argument Injection via git_blame

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the gitblame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

EUVD-2026-60900

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

EUVD-2026-60895

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

SUSE CVE-2026-53797

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically replace a parent directory component with ...

SUSE CVE-2026-53801

rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of...

PT-2026-77243

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1 Description The find icon path zip function in mobsf/StaticAnalyzer/views/android/icon analysis.py fails to properly validate the android:icon value from the Android manifest. This allows an authenticated user to...

PT-2026-77120

Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

EUVD-2026-60394

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

CVE-2026-75482 SWE-agent Trajectory Inspector Path Traversal File Disclosure

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

CVE-2026-75482 SWE-agent Trajectory Inspector Path Traversal File Disclosure

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...