EUVD-2026-75580

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

GO-2026-6439 Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost

Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost...

github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter vulnerability

WordPress AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin = 11.0.4 - Unauthenticated Arbitrary File Read via 'username' Parameter vulnerability discovered by daroo in WordPress Plugin AcyMailing SMTP Newsletter versions = 11.0.4...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

DEBIAN-CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828

A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...

EUVD-2026-75396

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

weasyprint Has Server-Side Request Forgery (SSRF)

Summaryurlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input.Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...

PYSEC-2026-3940 weasyprint Has Server-Side Request Forgery (SSRF)

Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...

vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Summaryvllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...

PYSEC-2026-3934 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections

Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...

PYSEC-2026-3837 GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

SummaryTagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...