PT-2026-78544

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.22.0 Description Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can lead to requests from the...

PT-2026-78344

Unauthenticated Local File Inclusion in Resido = 1.5 versions...

CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-52872

Streambert (Electron desktop app) is vulnerable prior to 2.5.0: the downloadSubtitleFile utility in src/ipc/downloads.js, reached via the run-download IPC channel, accepts a renderer-supplied file: URI and passes its decoded pathname to fs.copyFileSync, while the renderer also controls the destin...

CVE-2026-52872 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

CVE-2026-48796 CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...

CVE-2026-48796 CefSharp: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...

@rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-28570

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

EUVD-2026-60806

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

CVE-2026-73400

CVE-2026-73400 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Restaurant Menu by MotoPress , affecting versions 2.4.11 and below . The flaw allows a remote, unauthenticated attacker to include and read local files on the server, potentially leading to full ...

CVE-2026-32464

The WordPress plugin Theme Test Drive (versions ≤ 2.9.1) is affected by an unauthenticated Local File Inclusion vulnerability discovered by Steven Julian, allowing remote attackers to read arbitrary server files without authentication (CVSS 8.1 HIGH). Patchstack reports the flaw but no patch vers...

CVE-2026-32464 WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

EUVD-2026-60900

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

CVE-2026-28570

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...