CVE-2026-103928 Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or...

DEBIAN-CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109956 NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-109956

The NLTK library (versions through 3.10.3 ) contains a path traversal vulnerability within the WekaClassifier component. The root cause is the use of unvalidated model paths, which allows attackers to bypass nltk.pathsec containment. By controlling the model_filename or model argument, an attacke...

CVE-2026-85114

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.61. Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write...

ogmios-queryledgerstate-dump-poc

Ogmios queryLedgerState/dump — Unauthenticated Arbitrary Fil...

CVE-2026-85114

A vulnerability exists in the .NET Client Library for SIMATIC S7 Webserver API (all versions

CVE-2026-85114

A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API All versions V3.3.61. Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write...

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin, in versions through 4.0.2 , contains an unauthenticated upload handler that fails to restrict the file type or destination . This flaw allows unauthenticated attackers to perform an arbitrary file write , placing files with arbitrary content in unauthori...

CVE-2026-89271 WP-BusinessDirectory <= 4.0.2 - Unauthenticated Arbitrary File Write via uploadFile

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

EUVD-2026-98300

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server...

CVE-2026-110235: Improper Limitation of a Pathname to a Restricted Directory

MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting fil...

PT-2026-111391

Name of the Vulnerable Software and Affected Versions .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61 Description Applications using the library do not properly validate filenames received from remote servers during ticket downloads. An attacker capable of manipulating t...

dockerd Go-Archive Arbitrary File Write

The vulnerability of the dockerd daemon in the Go-Archive library of the Docker Desktop command-line interface for developing and deploying container applications, as well as the Docker Compose tool for managing multi-container applications, is related to an incorrect definition of symbolic...

CVE-2026-109956: Improper Limitation of a Pathname to a Restricted Directory

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

PT-2026-111855

Name of the Vulnerable Software and Affected Versions Fossify File Manager versions prior to 1.6.3 Description A path traversal issue exists where crafted ZIP archives can write files outside the intended extraction folder. This occurs because of an unanchored startsWith check, allowing attackers...

Cisco License On-Prem Web Interface Arbitrary File Write DoS

The vulnerability in the web interface for managing Cisco License On-Prem previously known as Cisco Smart Software Manager On-Prem is related to deficiencies in the processing of relative paths to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files or caus...

Fortinet FortiManager Multiple Arbitrary File Read/Write via SQLi (FG-IR-26-178)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the FG-IR-26-178 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported...