CVE-2026-81651

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authenticated cross-gallery settings modification due to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify gallery ownership when a user saves settings, allowing any user with gallery-manag...

EUVD-2026-83663

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

CVE-2026-81651 NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on the site, including its filesystem path...

PT-2026-95916

Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

CVE-2026-77385: Authorization Bypass Through User-Controlled Key

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

EUVD-2026-77713

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

CVE-2026-89248 AVideo WebRTC Plugin Information Disclosure via status.json.php

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

CVE-2026-89248: Exposure of Sensitive Information to an Unauthorized Actor

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json.php. When the WebRTC plugin is present, any unauthenticated remote user can request /plugin/WebRTC/status.json.php and receive JSON containing the absolute...

GO-2026-6398 SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel...

CVE-2026-19729

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

EUVD-2026-57462

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath...

EUVD-2026-54577

Kirby: System path exposure from error messages in the REST API...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

CVE-2026-62865 TypeBot: Arbitrary server file read via Send Email block attachment path

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...

DEBIAN-CVE-2026-78677

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

CVE-2026-19912: Improper Input Validation

The Kaltura HTML5 player mwEmbed / html5lib contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize, and the...