12614 matches found
CVE-2026-18352
The WordPress plugin User Access Manager (up to version 2.3.15) is vulnerable to Directory Traversal via the uamgetfile parameter. Unauthenticated attackers can read arbitrary server files because attachment_url_to_postid() may return 0 for a traversal path, causing the code to fall back to a glo...
Arbitrary File Read
Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...
CVE-2026-15932 Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal
The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server...
CVE-2026-15932
The CVE applies to the Support Genix WordPress plugin prior to 1.4.48. Affected component: ticket-attachment download route; root cause: directory traversal not prevented. Impact: unauthenticated read of arbitrary files with allowlisted extensions, including other users’ private attachments (serv...
CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...
CVE-2026-15006
The Bit integrations plugin for WordPress (Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation) is affected by a Directory Traversal vulnerability in the processAttachment function, impacting all versions up to 2.9.0. This allows unauthenticated attackers to read arbitrary server...
VulnCheck KEV: CVE-2026-48313
ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive...
PT-2026-67027
The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp get svg content' function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...
CVE-2026-54785
gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...
GHSA-G65V-27R3-5P6M guard-livereload has a directory traversal vulnerability
The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality. This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse...
GHSA-C5PX-58J2-7FQP gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
Summary consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip and...
CVE-2026-54785 gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...
EUVD-2026-51677
gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consultgeminiwithfiles in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to th...
CVE-2026-54785
CVE-2026-54785 affects gemini-bridge, a lightweight MCP server that bridges AI agents to Google’s Gemini CLI. From versions 1.0.0 through 1.3.1, the inline mode function consult_gemini_with_files accepts a files argument containing a file path and does not confine it to the working directory, cau...
Exploit for CVE-2026-66066
KindaRails2Shell: CVE-2026-66066 A zero-dependency, single-fi...
GHSA-6HM5-JGCP-P838 Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
Summary A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can influence the fileids argument of its public read methods header, raw, words, sents, taggedwords to read files outside the corpus root. The reader builds the file path with no containment check and opens it with...
GHSA-XH95-F55M-82FW Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
Summary FramenetCorpusReader.framename interpolates a caller-supplied frame name into an XML file path that is read with the builtin open, bypassing CorpusReader.open and the nltk.pathsec sandbox — including strict ENFORCE=True mode. A ../ sequence in the name escapes the corpus root, yielding an...