CVE-2026-111728

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-111728 Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

EUVD-2026-102897

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-111728

Seanime versions v3.7.0 to v3.10.3 are vulnerable to an argument injection vulnerability due to improper authorization. Unauthenticated LAN or Tailnet clients can bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and providing attacker-controlled decodeFlags a...

CVE-2026-93767

The Tainacan plugin for WordPress (versions up to and including 1.3.0 ) is vulnerable to a Directory Traversal vulnerability via the 'guid' parameter . This flaw allows authenticated attackers with Subscriber-level access or higher to perform an arbitrary file read , potentially exposing sensitiv...

CVE-2026-93767 Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...

CVE-2026-104769

The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.3.0 . The flaw exists in the 's' parameter and allows an unauthenticated visitor to read arbitrary files on the server, potentially exposing sensitive infor...

PT-2026-115628

Name of the Vulnerable Software and Affected Versions Seanime versions 3.7.0 through 3.10.3 Description Improper authorization allows unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard. By setting transcodeHwAccel to custom and providing attacker-controlled...

CVE-2026-111728: Improper Neutralization of Argument Delimiters in a Command

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags...

CVE-2026-96424: Incorrect Permission Assignment for Critical Resource

Incorrect DBus policy for lomiri-upload-manager part of lomiri-download-manager allows arbitrary user to read arbitrary file as root over DBus...

CVE-2026-111635: Improper Limitation of a Pathname to a Restricted Directory

Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension...

CVE-2026-111613: Missing Authentication for Critical Function

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...

PT-2026-116034

🚨 CVE-2026-111635 Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an...

PT-2026-115650

Name of the Vulnerable Software and Affected Versions lomiri-download-manager affected versions not specified Description An incorrect DBus policy in the lomiri-upload-manager component of lomiri-download-manager allows an arbitrary user to read arbitrary files with root privileges over DBus. DBu...

CVE-2026-105037

EnergizeLab station-middleware (NestJS) Docker images, specifically versions 1.6.5 through 1.8.2 , are vulnerable to an authenticated path traversal vulnerability. A registered, low-privilege account can read arbitrary files from the server by providing an attacker-controlled file path. This flaw...

CVE-2026-105037 EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...

CVE-2026-111234

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...

CVE-2026-111230

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in servicesdyndnsedit.php. Attackers can set a non-matching Result Match string so checkStatus logs file...

EUVD-2026-102346

SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing filegetcontents to read...