PT-2026-55289

Name of the Vulnerable Software and Affected Versions Cockpit CMS versions prior to 364 Description Unauthenticated attackers can read arbitrary files or execute PHP files due to a path traversal and local file inclusion issue. The application fails to perform containment checks when constructing...

CVE-2026-57749: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in SportsPress Pro = 2.7.29 versions...

CVE-2025-69133: Improper Control of Filename for Include/Require Statement in PHP Program

Subscriber Local File Inclusion in Tourmaster = 5.4.5 versions...

PT-2026-54959

Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...

CVE-2025-58902: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...

PT-2026-56962

Name of the Vulnerable Software and Affected Versions CodexThemes TheGem Theme Elements for Elementor versions prior to 5.11.2 Description An improper control of filenames for include/require statements allows for Local File Inclusion. Authenticated attackers with contributor-level access or high...

CVE-2026-27412: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Pearl - Corporate Business = 3.4.10 versions...

PT-2026-54975

Name of the Vulnerable Software and Affected Versions Pearl - Corporate Business versions prior to 3.4.11 Description An unauthenticated Local File Inclusion LFI issue exists, which allows an attacker to read files from the local file system without requiring authentication. Recommendations Updat...

CVE-2026-42382: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Audrey = 1.5 versions...

PT-2026-55036

Contributor Local File Inclusion in Shopify = 1.0.0 versions...

CVE-2026-58467: Improper Limitation of a Pathname to a Restricted Directory

Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATHINFO derived from REQUESTURI in filesystem path construction without containment checks...

PT-2026-54984

Unauthenticated Local File Inclusion in Audrey = 1.5 versions...

CVE-2026-57748: Improper Control of Filename for Include/Require Statement in PHP Program

Contributor Local File Inclusion in Shopify = 1.0.0 versions...

bugspray

🔴 Bugspray Multi-vector web application vulnerability scann...

WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Tourmaster versions = 5.4.5...

WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Audrey versions = 1.5...

WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability

WordPress Pearl - Corporate Business theme = 3.4.10 - Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Pearl - Corporate Business versions = 3.4.10...

WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Lighthouse versions = 1.2.12...

Ray Path Traversal vulnerability

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

PYSEC-2026-516 Ray Missing Authorization vulnerability

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...