PT-2026-85483

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2 Description A path traversal issue exists in the file-read endpoint accessible to users with the reader role. The system follows symbolic links symlinks when opening authorized asset paths under data/assets/. Thi...

PT-2026-85573

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument...

PT-2026-85470

A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit ADK versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file path query parameter...

Security Bulletin: Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

Summary Langflow uses filesystem path construction as part of several components and API endpoints, including the Directory component, the Knowledge Base connector ingestion endpoint, and the Knowledge Base flow component. In the Directory component, user-supplied path values are not validated...

Security Bulletin: MongoDB Enterprised Advanced affected by: Path Traversal (CVE-2026-49356)

Summary There are vulnerabilities in core-7.26.10.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-49356. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-49356 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f)

Summary SiYuan's /export/ file handler was hardened against export disclosure issue 12213 by adding an IsSubPathexportBaseDir, fullPath check and an IsSensitivePath check in commit bb481e1. These guards were added only to the main branch of the handler. The handler begins with a short-circuit...

CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85176

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName to bypass directory containment and access sensitive files including encrypted database credentia...

CVE-2026-85170

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.33.3.SP1 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

resteasy-core: RESTeasy SourceProvider remote unauthenticated file read

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5.SP1 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...

CVE-2026-85170 n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail v1 and Brevo nodes to the mail composer without verifying it is a string. An authenticated user able to run a workflow can supply an expression that resolves to an object carrying a path or href property, causing t...