CVE-2026-86671

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

EUVD-2026-92474

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later , the GET /api/scm/resolve and POST /api/factory/resolver endpoints are vulnerable to Server-Side Request Forgery (SSRF) . The application passes attacker-controlled URLs to URLFetcher.fetch() without an allow-list for schemes or hosts. Consequently, an au...

CVE-2026-89039

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039

The k6 MCP server is vulnerable to a path traversal flaw in the convert_playwright_script prompt via the playwright_script argument. While @-prefixed paths are restricted to the current working directory, bare paths follow an undocumented code path with no restrictions, allowing callers to read a...

EUVD-2026-92434

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6

A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...

Pulse Secure SSL VPN File Read (CVE-2019-11510)

Exploits CVE-2019-11510 path traversal in Pulse Connect Secure to read arbitrary files such as /etc/passwd and VPN session data. !/usr/bin/env python3 -- coding: utf-8 -- """Pulse Secure SSL VPN arbitrary file read CVE-2019-11510.""" import re from kittysploit import from...

Xiaomi Mi WiFi R3G LFI (CVE-2019-18371)

Exploits CVE-2019-18371 in Xiaomi Mi WiFi R3G 2.28.23: NGINX alias misconfiguration allows reading /etc/config/account and other files via api-third-party/download. !/usr/bin/env python3 -- coding: utf-8 -- """Xiaomi Mi WiFi R3G NGINX alias LFI CVE-2019-18371.""" import re from kittysploit import...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

Fieldgate SWG70 LFI (CVE-2018-16059)

Exploits CVE-2018-16059 in WirelessHART Fieldgate SWG70 3.0: path traversal via fcgi-bin/wgsetcgi filename parameter reads /etc/passwd and other files. !/usr/bin/env python3 -- coding: utf-8 -- """Endress+Hauser Fieldgate SWG70 LFI CVE-2018-16059.""" import re from kittysploit import from...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

Grafana Plugin Path Traversal LFI (CVE-2021-43798)

Exploits CVE-2021-43798 in Grafana 8.x: directory traversal via /public/plugins/NAME/ allows reading arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana plugin path traversal LFI CVE-2021-43798.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Kibana Console Path Traversal LFI (CVE-2018-17246)

Exploits CVE-2018-17246 in Kibana 6.4.3 / 5.6.13: path traversal in /api/console/apiserver apis parameter reads arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Console plugin path traversal LFI CVE-2018-17246.""" import re from kittysploit import from...

DEBIAN-CVE-2026-63268

LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml...

DEBIAN-CVE-2026-63267

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-63267

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

UBUNTU-CVE-2026-63267

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...