CVE-2026-63312: Improper Limitation of a Pathname to a Restricted Directory

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

PT-2026-79569

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.9.4 Description A symlink escape issue exists in the CorpusReader.open function. This occurs because path validation is performed lexically and fails to account for symlink resolution. Consequently, a local attacker ca...

PT-2026-79563

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An arbitrary local file read issue exists in StreamBackedCorpusView where the system bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid...

CVE-2026-49360 Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Recce is a data-validation toolkit for enhanced dbt data build tool PR review. Prior to version 1.50.0, OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured...

CVE-2026-49360

Recce (a data-validation toolkit for dbt PR review) versions prior to 1.50.0 are vulnerable to unauthenticated SQL execution through the query run API when deployed with a DuckDB-backed project and exposed to an untrusted network without authentication. An attacker can leverage DuckDB filesystem ...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

CVE-2026-47735

Arc (Basekick Labs) is an open-source SQL-native time-series database for telemetry. Prior to 26.06.1 , its user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist, while the broader DuckDB I/O function family (read_csv_au...

CVE-2026-47735 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc's user-SQL validator internal/api/query.go:ValidateSQLRequest blocked only readparquet and arcpartitionagg via regex denylist. The broader DuckDB I/O function family — readcsvauto, readcsv, readjson,...

GHSA-74FJ-2J2H-C42Q vulnerabilities

Vulnerabilities for packages: arangodb...

CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cau...

CVE-2026-62668

Grav API Plugin (RESTful API for Grav CMS) prior to 1.0.6 is vulnerable to SSRF via unrestricted cURL protocols in webhook dispatch. The WebhookController.php accepts webhook URLs with only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS...

CVE-2026-62668 Grav API Plugin: Webhook SSRF via Unrestricted cURL Protocols

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTERVALIDATEURL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPTPROTOCO...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-76210

phpMyFAQ before 4.1.6 (some sources cite 4.1.7) contains an inadequate HTML sanitization flaw in FAQ answers before PDF generation via TCPDF . An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory (e.g...

PT-2026-78544

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.22.0 Description Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can lead to requests from the...

CVE-2026-75844 ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

EUVD-2026-60608

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...