CVE-2026-78208

exceljs-hardened before 5.0.0 (and exceljs through 4.4.0) is affected by a path traversal vulnerability in the Workbook.addImage() function. The function fails to validate file path inputs, allowing an attacker to supply an arbitrary path that reads any file accessible to the Node.js process and ...

CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-19093

The Tutor LMS WordPress plugin, in versions prior to 4.0.6 , is vulnerable to an Arbitrary File Read vulnerability. The root cause is a failure to validate stored file paths before using them to stream media. This allows users with the instructor role to read arbitrary files on the server, includ...

CVE-2026-48105 Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

EUVD-2026-64192

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-49360: External Control of File Name or Path

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-48752: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

CVE-2026-48749: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...

CVE-2026-77176: External Control of File Name or Path

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

CVE-2026-76390

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76357

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer REST API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and do...

CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-49392

Wazuh (free and open source threat prevention, detection, and response platform) is affected by a local SQL injection in its File Integrity Monitoring (FIM) database layer. The vulnerable functions DB::getFile() and DB::searchFile() in src/syscheckd/src/db/src/file.cpp concatenate a monitored fil...

CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can provide a...

CVE-2026-49255

In electerm versions prior to 3.11.11, the rmrf(), mv(), and cp() functions in src/app/lib/fs.js interpolate untrusted file paths into shell command strings without escaping metacharacters. A malicious SSH/SFTP server can supply filenames like file"$(touch /tmp/pwned)" to break out of quotes and ...

PT-2026-78650

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 9.75 Description An authenticated user with attachment upload privileges can execute arbitrary commands as the Wekan server process on deployments where an external scanner is configured. The issue occurs in...

PT-2026-78784

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description An authenticated user without an assigned role can execute arbitrary code by submitting a crafted file path to the Representational State Transfer REST API. This occurs because the REST API does...

PT-2026-78817

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description An unauthenticated user can access the add-on OpenAPI specification via Splunk Web static file paths. This exposure occurs because the generated OpenAPI...