EUVD-2026-108231

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

CVE-2026-114606 draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFil...

CVE-2026-114606

Versions of draw.io Desktop prior to 31.4.4 are vulnerable to arbitrary local-file disclosure . The root cause is an authorization asymmetry in the Electron main process's read-side IPC handlers. While write-side handlers (such as saveFile and writeFile) are protected by assertWritablePath, the r...

Insecure Default Initialization of Resource

Overview storybook is a frontend workshop for building UI components and pages in isolation. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the...

Insecure Default Initialization of Resource

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

Insecure Default Initialization of Resource

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config when usi...

Insecure Default Initialization of Resource

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved project config...

Insecure Default Initialization of Resource

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not applied to the resolved...

Insecure Default Initialization of Resource

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Vitest plugin in storybookTest, where allowWrite and allowExec permissions are not...

SUSE CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

EUVD-2026-108228

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068 JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore

JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craf...

CVE-2026-104068

The JetBackup plugin for WordPress (versions before 3.1.24.10 ) is vulnerable to a symlink-based arbitrary file write flaw during the backup import and restore process. The root cause is the failure to validate symbolic links or enforce destination containment when extracting backup archives, all...

GHSA-PJVX-PRJX-H659 nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Summary nbconvert = v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor,...

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc

Summary nbconvert = v7.17.1 has an arbitrary file write vulnerability due to a path traversal in ipynb cell output metadata, more specifically on the filename attribute. Vulnerable converters : --to markdown, --to latex, --to rst, --to asciidoc. In ExtractOutputPreprocessor,...

EUVD-2026-107551

nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the preprocesscell function in nbconvert/preprocessors/extractoutput.py, where the filename field from cell output metadata is used without sanitization. An attacker who controls notebook content can supply a...

openscap: openscap: Arbitrary file write via path traversal in Source DataStream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...

CVE-2026-16477

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file editable screenshot annotations. Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automaticall...