CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CLEANSTART-2026-YN04492 On Unix systems, opening a file in an os

CVE-2026-39822 affects multiple packages. On Unix systems, opening a file in an os. See references for individual vulnerability details...

CLEANSTART-2026-FW80348 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Security vulnerability affects the httpbin package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels...

EUVD-2026-107647

In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator URL of the Splunk SOAR instance, the...

lrzsz security, bug fix, and enhancement update

An update is available for lrzsz. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmode...

RLSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-121351

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db backup and ../ sequences in name to read files like...

ROS-20261022-73-0019

The vulnerability of the RDPDR IRP RDP-client FreeRDP module is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain access to read, write, and delete arbitrary files...

PT-2026-121406

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...

PT-2026-121479

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions 3.3.0 through 3.10.7 PhpSpreadsheet versions prior to 5.10.0 Description Processing attacker-controlled SpreadsheetML XML can lead to entity-expansion denial of service, local file access, or Server-Side Request Forgery...

RESTEasy 6.2.2 Insecure Temporary File Permissions

RESTEasy versions through 6.2.2 contain an insecure temporary file permissions issue that may allow a local user to read sensitive temporary-file contents...

PT-2026-121376

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

CVE-2021-48013: Improper Limitation of a Pathname to a Restricted Directory

Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive...

PT-2026-121316

Name of the Vulnerable Software and Affected Versions WatchGuard Endpoint Security affected versions not specified Description WatchGuard Endpoint Security's Full Disk Encryption feature for macOS stores sensitive information in cleartext. A local, unprivileged user or process can obtain the...

CVE-2022-51022: Improper Limitation of a Pathname to a Restricted Directory

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

Python CPython security vulnerabilities

A security vulnerability exists in Python versions prior to CPython 3.16.0. This vulnerability arises because tarfile.tarfilter can be bypassed via specially crafted link entries—such as symbolic links with empty names or similar directory names—which redirect subsequent archive members away from...

PT-2026-121480

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet versions prior to 1.30.7 PhpSpreadsheet versions prior to 2.1.19 PhpSpreadsheet versions prior to 2.4.8 PhpSpreadsheet versions prior to 3.10.8 PhpSpreadsheet versions prior to 5.10.0 Description The XmlScanner::scan function in...

PT-2026-121378

Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file'...

CVE-2019-25779: Improper Limitation of a Pathname to a Restricted Directory

WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read arbitrary files through the calendar parameter of download.php. Attackers can send GET requests with file:// scheme paths to the calendar parameter to disclose sensitive files like...

PT-2026-121424

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...