PT-2026-84521

Name of the Vulnerable Software and Affected Versions Vitest versions 2.1.0 through 4.1.10 Vitest versions 5.0.0-rc.0 through 5.0.0-rc.1 Description The mockerPlugin and interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on...

CVE-2026-53508

oasdiff (a Go command-line tool and package for comparing OpenAPI specs, hosted at github.com/oasdiff/oasdiff ) failed to enforce the --allow-external-refs=false flag on the git-revision load path (rev:path form, e.g. main:openapi.yaml). From version 1.13.2 through 1.18.0 , external $refs were re...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-63312

A flaw was found in NLTK. This vulnerability, specifically within the StreamBackedCorpusView component, allows an attacker to bypass security enforcement by directly calling builtins.open instead of the intended pathsec.open. By controlling the fileid argument, an attacker can read arbitrary loca...

CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

UBUNTU-CVE-2026-82660

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660 Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-82660

Nodemailer before version 8.0.9 is affected by an access-control bypass in jsonTransport during message normalization. The disableFileAccess and disableUrlAccess options are not enforced, allowing an attacker to read local files or fetch arbitrary URLs by supplying crafted path or href values in ...

EUVD-2026-68438

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

Linux Distros Unpatched Vulnerability : CVE-2026-82660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local...

XML External Entity (XXE) Injection

mapfish-print is vulnerable to XML External Entity XXE Injection. The vulnerability is due to improper parsing of attacker-controlled XML with external entities and DTDs enabled, which allows an unauthenticated attacker to read local files and perform server-side request forgery SSRF by accessing...

WordPress WP Maps plugin < 4.9.7 - Subscriber+ Local File Inclusion vulnerability

Subscriber+ Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin WP Maps versions 4.9.7...

WordPress WP Maps Pro plugin < 6.1.3 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by Jakub Herman in WordPress Plugin Advanced Google Maps versions 6.1.3...

SUSE CVE-2024-29180

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cpio (UTSA-2026-092966)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-092966 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. Tenable has...

CVE-2026-56651

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to...

CVE-2026-81659

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export...

CVE-2026-76845

A flaw was found in adm-zip, a Node.js library used for handling zip archives. This vulnerability allows a local attacker to overwrite arbitrary files on the system. When extracting an archive, adm-zip follows symbolic links, which are special files that point to other files or directories. An...