PT-2026-76805

Name of the Vulnerable Software and Affected Versions Evidently UI affected versions not specified Description An issue exists where the software fails to properly validate the filename parameter in the dataset materialization endpoint. This allows unauthenticated attackers to read arbitrary file...

PT-2026-76704

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE...

Unity Linux 20.1070e Security Update: ImageMagick (UTSA-2026-099463)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099463 advisory. In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the...

FileRise <= 3.3.0 - Unauthenticated File Read

FileRise = 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths. id: CVE-2026-25231 info: name: FileRise = 3.3....

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604 Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-17604

The CVE (CVE-2026-17604) affects the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. All versions up to 6.1.1 are vulnerable to Directory Traversal via the data parameter. Authentication with at least editor-level access is required, enabling an attacker to read arbi...

CVE-2026-17604

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

EUVD-2026-59928

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

CVE-2026-15056

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-15056 StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-15056 StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-15056

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-15056

The CVE concerns the StoreEngine WordPress plugin (StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More). Affected: all versions up to and including 2.1.1. Vulnerability type: Directory Traversal via the parse_file_path function, allowing an authenticated attac...

EUVD-2026-59900

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

PT-2026-73104

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parse file path function. This makes it possible for authenticated attackers, with vendor-leve...

CVE-2026-34492 Airwall - Arbitrary file read

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-73619

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the unsafegitarchiveoptions guard, an attacker can supply specific options, such as --add-file or --add-virtual-file, to the Repo.archive...

CVE-2026-45774

A flaw was found in compliance-trestle. The library's profile import mechanism, which handles trestle:// URIs and relative file paths, does not properly validate paths. This allows a remote attacker to craft a malicious OSCAL Open Security Controls Assessment Language profile YAML file containing...