Lucene search
+L

13341 matches found

Cvelist
Cvelist
added 2026/07/28 5:58 p.m.38 views

CVE-2026-48374 Bridge | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation...

7.8CVSS0.00232EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/28 5:58 p.m.9 views

CVE-2026-48374

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation...

7.8CVSS5.9AI score0.00232EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/28 5:58 p.m.43 views

CVE-2026-48374

Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability that could enable arbitrary file system read outside the intended scope. Exploitation requires user interaction : a victim must open a malicious file. The CVSS 3.1 metrics indicat...

7.8CVSS5.9AI score0.00232EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/07/28 4:30 p.m.45 views

CVE-2026-67185 TinyWeb 0.0.8 Path Traversal via URL Path Component

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

8.7CVSS0.00453EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 2026/07/28 12:00 a.m.19 views

PT-2026-65614

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.62.0 Description An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema $ref targets. The application fails to restrict these targets to the...

7.5CVSS5.7AI score0.0043EPSS
SaveExploits1References9
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2026-45623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prio...

9.1CVSS5.4AI score0.00587EPSS
SaveExploits1References4
NVD
NVD
added 2026/07/27 6:16 p.m.14 views

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

9.8CVSS0.00603EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/27 6:16 p.m.6 views

DEBIAN-CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

9.1CVSS5.8AI score0.00587EPSS
SaveExploits1References1
UbuntuCve
UbuntuCve
added 2026/07/27 6:16 p.m.7 views

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

9.1CVSS5.4AI score0.00587EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/07/27 5:54 p.m.10 views

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

9.8CVSS6.2AI score0.00603EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/07/27 5:23 p.m.8 views

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

7.5CVSS5.8AI score
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/27 5:23 p.m.103 views

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

7.5CVSS0.00587EPSS
SaveExploits1References1
CVE
CVE
added 2026/07/27 5:23 p.m.274 views

CVE-2026-45623

PostCSS vulnerability CVE-2026-45623 affects versions up to 8.5.11. The PreviousMap parses the /*# sourceMappingURL=PATH */ comment from CSS, dereferencing PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker-controlled CSS input can cause the host process...

9.1CVSS5.8AI score0.00587EPSS
SaveExploits1References1Affected Software1
OSV
OSV
added 2026/07/27 3:55 p.m.7 views

OPENSUSE-SU-2026:21448-1 Security update for agama-web-ui

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames bsc1272310....

9.4CVSS6.7AI score0.01686EPSS
SaveExploits4References27
OSV
OSV
added 2026/07/27 1:45 p.m.6 views

SUSE-SU-2026:3283-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

9.8CVSS6.1AI score0.00479EPSS
SaveExploits0References13
RedhatCVE
RedhatCVE
added 2026/07/27 10:51 a.m.8 views

CVE-2026-65920

A flaw was found in Diffusers. This path traversal vulnerability in the getcheckpointshardfiles function allows a remote attacker to read arbitrary files. By supplying malicious weightmap values in model index JSON, an attacker can use ../ sequences or absolute paths to escape the model directory...

5.3CVSS5.9AI score0.00398EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/27 6:00 a.m.25 views

CVE-2025-15662

The CVE-2025-15662 issue affects the Printcart Web to Print Product Designer for WooCommerce WordPress plugin up to version 2.5.3. The root cause is that the plugin does not restrict a user-supplied URL before server-side fetching and does not enforce a valid authorization check, enabling unauthe...

8.6CVSS5.9AI score0.00323EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/27 6:00 a.m.43 views

CVE-2025-15662 Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

0.00323EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/27 6:00 a.m.11 views

CVE-2025-15662

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

5.9AI score0.00323EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/07/27 12:00 a.m.12 views

Linux Distros Unpatched Vulnerability : CVE-2026-65698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host file...

6CVSS5.7AI score0.0047EPSS
SaveExploits0References2
Rows per page
Query Builder