PT-2026-89646

Name of the Vulnerable Software and Affected Versions Docmost versions 0.2.1 through 0.21.0 Description An unauthenticated actor can disclose local files through a path traversal issue caused by improper handling of avatar attachments. This is achieved by sending a POST request to a public URL...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection through the high-level diff API in git/diff.py and git/repo/base.py. An attacker can turn repo.index.diff..., noindex=True into a blind...

File Inclusion postcss Dependency in Jira Software Data Center

This High severity File Inclusion vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This File Inclusion vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

CVE-2026-84373: Improper Limitation of a Pathname to a Restricted Directory

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

PT-2026-84521

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0 through 4.1.10 Vitest versions 5.0.0-rc.0 through 5.0.0-rc.1 Description The mockerPlugin and interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on...

CVE-2026-81659 Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

PT-2026-82491

Name of the Vulnerable Software and Affected Versions Flowintel affected versions not specified Description An issue exists where attacker-controlled note content is processed by Pandoc and XeLaTeX during PDF export. This can lead to the unauthorized reading of local files from the Flowintel...

TencentOS Server 3: yelp (TSSA-2026:0898)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0898 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

SUSE CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

Debian dsa-6467 : freecad - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6467 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6467-1 [email protected] https://www.debian.org/securit...

CVE-2026-65646: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

EUVD-2026-65615

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) is vulnerable to local file disclosure in versions v2.45, v2.103 and earlier , and other v2.x releases. The root cause is the improper validation of the ServiceUrl parameter in mwEmbedLoader.php, which accepts non-HTTP schemes like file://. Due to an ...

CVE-2026-19913 CVE-2026-19913

The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Repo.blame and Repo.blameincremental option check in git/repo/base.py. An attacker can read local files by supplying a blame...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path through the Submodule.configparser path in git/objects/submodule/base.py. An attacker can disclose the first line of a readable...

Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7833-fr7j-v32q. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local...

PYSEC-2026-3785

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PYSEC-2026-3785

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...