PT-2026-89329

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

CVE-2026-9225: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

PT-2026-89361

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

PT-2026-89618

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Improper access control allows a remote authenticated attacker to read arbitrary files from the system. Recommendations Update IBM Langflow OSS to a version later than 1.11.5...

CVE-2026-88937: Improper Limitation of a Pathname to a Restricted Directory

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal...

CVE-2026-18386: Improper Limitation of a Pathname to a Restricted Directory

The WP BackItUp Community Edition plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.0 via the 'backupfile' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of...

Linux Distros Unpatched Vulnerability : CVE-2026-84828

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command...

MikroTik RouterOS 7.20 < 7.23.4 / 7.24.x < 7.24.2 WebFig Unauthenticated File Read (CVE-2026-67281)

According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.20 prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by an information disclosure vulnerability. RouterOS WebFig contains an unauthenticated file-read vulnerabilit...

Ubuntu 20.04 LTS / 22.04 LTS : Apache Tika vulnerability (USN-8717-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8717-1 advisory. It was discovered that Apache Tika's ISA-Tab parser incorrectly handled file path resolution. An attacker who could place files in a directory that Ti...

hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines

A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the...

github.com/gohugoio/hugo: Hugo: Arbitrary file read via symbolic link sandbox escape

A flaw was found in Hugo. This vulnerability allows information disclosure when Hugo executes build tools under the Node.js permission model, which validates only lexical file paths and fails to restrict symbolic links pointing outside the sandbox. An attacker capable of contributing content to a...

CVE-2026-15913

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-15913

Fortra's GoAnywhere MFT versions prior to 7.10.2 are affected by a path traversal vulnerability in the /attachRemoteFiles endpoint. An authenticated Web User holding both Secure Folders and Secure Mail permissions can escape their sandboxed home directory, enabling arbitrary file read . The CNA-a...

GHSA-M4F3-G4CQ-HQRX vulnerabilities

Vulnerabilities for packages: checkov...

weasyprint Has Server-Side Request Forgery (SSRF)

Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...

GHSA-JF6Q-CHMF-3H3V weasyprint Has Server-Side Request Forgery (SSRF)

Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...

CVE-2026-85788

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-85788

CVE-2026-85788 affects the mutable SQL detector component in Amazon awslabs mysql-mcp-server . An incomplete list of disallowed inputs allows context-dependent actors to bypass the read-only enforcement gate by crafting SQL inline comments that the regex engine does not treat as whitespace, reach...