CVE-2026-103928

The business intelligence platform Metabase is vulnerable to arbitrary file read and write in versions 1.55.0 through 1.58.16, 1.59.13, 1.60.9, and 1.61.4. The root cause is the failure to restrict host-facing built-in functions when processing native queries or actions against an H2 data source ...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

CVE-2026-74034

Wazuh versions 4.1.0 before 4.14.8 are vulnerable to an arbitrary file read vulnerability due to a missing origin check in the wm_agent_upgrade component. This flaw allows enrolled agents to issue upgrade_custom commands using an attacker-controlled file_path . An attacker can inject an upgrade_c...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

CVE-2026-74034 Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wmagentupgrade that allows enrolled agents to issue upgradecustom commands with attacker-controlled filepath. Attackers can inject an upgradecustom message over the agent channel to read arbitrary files as root, exfiltrating...

EUVD-2026-98164

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

EUVD-2026-98157

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

Fortinet FortiManager Multiple Arbitrary File Read/Write via SQLi (FG-IR-26-178)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-26-178 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

VulnCheck KEV: CVE-2025-10897

The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read...

PT-2026-113546

Name of the Vulnerable Software and Affected Versions Citrix UniconOS versions prior to 2607.2 CR Citrix UniconOS versions prior to 2603 LTSR CU2 Description An issue in Citrix UniconOS allows for arbitrary file read and write operations, enabling an attacker to access or modify files on the syst...

CVE-2026-106616: Improper Restriction of XML External Entity Reference

ColdFusion is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issu...

CVE-2026-54640: Improper Restriction of XML External Entity Reference

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the KNXProtocol.startAssetImport method in agent/src/main/java/org/openremote/agent/protocol/knx/KNXProtocol.java processes 0.xml from an authenticated user's uploaded ETS project ZIP with Saxon TransformerFactoryImpl and...

Fortinet FortiAnalyzer Multiple Arbitrary File Read/Write via SQLi (FG-IR-26-178)

The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-26-178 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...

CVE-2026-53564: Improper Limitation of a Pathname to a Restricted Directory

Vulnerability in Citrix UniconOS leading to Arbitrary file read and write This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2...

CVE-2026-109601

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

UBUNTU-CVE-2026-109574

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...

CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-109601 Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML

Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files...

CVE-2026-109601

The Frappe Framework is vulnerable to an arbitrary file read vulnerability in versions before 15.117.0 and 16.x before 16.30.0 . The root cause lies in the handling of attributes within outgoing email HTML content. An attacker capable of supplying outgoing email content can set an attribute value...

CVE-2026-109574

Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through the Sass compiler's import fallback. Attackers can ship stylesheets with relative, absolute, or symlinked @import or @use targets to...