3630 matches found
CVE-2026-106047
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files...
CVE-2026-35029-PoC
CVE-2026-35029 — LiteLLM /config/update Broken Access Control LiteLLM 's /config/update endpoint does not check the caller's role privileges. Any authenticated user with a valid API Key without admin privileges can modify the proxy configuration, register malicious Pass-Through endpoints to achie...
EUVD-2026-97469
The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...
Shiny for Python has path traversal in bookmark restore
Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...
PT-2026-104077
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can...
Rocky Linux 9 [CIQ] Security Update: java-21-openjdk / java-21-openjdk-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_9689)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20269689 advisory. JDK: Enhance crypto algorithm support CVE-2026-22007 JDK: Improve Kerberos credentialing CVE-2026-22013 JDK: Enhance Path Factories Redux CVE-2026-22016 JD...
AlmaLinux 9.2 [TuxCare] Security Update: thunderbird Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785560172)
The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785560172 advisory. - Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would ...
PT-2026-102957
Name of the Vulnerable Software and Affected Versions wgagent affected versions not specified Description A missing authorization issue in the session initialization function of the wgagent management daemon allows an authenticated user with low privileges, such as a guest or read-only...
PT-2026-99793
Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Improper restriction of XML External Entity XXE references allows a weblog administrator to read files accessible by the Roller process and access internal network addresses. This occurs when importing a...
Pulse Connect Secure SSL VPN Arbitrary File Read
Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...
PT-2026-95140
Name of the Vulnerable Software and Affected Versions Frappe Learning Management System LMS versions prior to 2.52.1 Description A remote attacker can request a traversal path handled by the SCORMRenderer.render function in lms/page renderers.py. The renderer constructs and opens a server-side pa...
EUVD-2026-72669
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 All versions V3.1.13, SIMOVE Fleetmanager V3.2 All versions V3.2.4, SIMOVE Fleetmanager V3.3 All versions V3.3.2, SIMOVE Fleetmanager V4.0 All versions V4.0.1, SIPLANT V1.7 All versions, SIPLANT V2.2 All versions, SIPLANT V3.0 All...
SUSE CVE-2026-53474
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL...
EUVD-2026-71227
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
PT-2026-85544
Name of the Vulnerable Software and Affected Versions Postgres MCP Pro version 0.3.0 Description A restricted-mode bypass exists where function-name validation is not applied to RangeFunction nodes within FROM clauses. This allows attackers to bypass the allowlist and execute file-reading...
CVE-2026-85620: Incorrect Authorization
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...
CVE-2026-82525: Improper Restriction of XML External Entity Reference
Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...
UBUNTU-CVE-2026-84270
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
CVE-2026-84270
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device responds with more bytes than requested,...
