CVE-2026-119333

Prior to version 31.5.2 , draw.io Desktop on Windows is vulnerable to a search-path hijacking issue in src/main/electron.js . The application launched powershell and attrib using bare executable names. When a user opens a diagram from File Explorer, the diagram directory becomes the current worki...

CVE-2026-119333 draw.io Desktop allows Windows executable search-path hijacking

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-61618 SNARK Verifier: noncanonical accumulator limb decoding

SNARK Verifier is a generic SNARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulatorindices and passes them to...

CVE-2026-116249 pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116249

In pgAdmin 4 versions before 9.19 , a vulnerability exists where the application fails to properly sanitize file paths relative to the user's storage directory. Because get_complete_file_path() only strips leading slashes, an attacker can use path traversal sequences (e.g., ..//.pgpass) via the s...

CVE-2026-116249 pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

EUVD-2026-114390

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116243 pgAdmin 4: Utility binary path can point at a shared storage directory

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

EUVD-2026-114384

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

CVE-2026-116243

In pgAdmin 4 versions before 9.19, a vulnerability exists where the application failed to block utility binary paths (for pg_dump, pg_restore, pg_dumpall, and psql) pointing to a SHARED_STORAGE directory. Because ordinary users can upload files to shared storage, an attacker could upload an execu...

CVE-2026-116240 pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116240

In server mode, pgAdmin 4 (versions before 9.19 ) is vulnerable to path traversal and TOCTOU issues due to inconsistent path handling in check_access_permission(). The system validates one path but subsequently acts on a differently constructed path. Specifically, stripping slashes can allow acce...

EUVD-2026-114381

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116240 pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-119328 Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...

CVE-2026-119328

The Immich photo and video management solution (prior to version 3.3.0 ) contains an unauthenticated filesystem path injection vulnerability in the machine-learning /predict endpoint. The flaw exists because the machine-learning/immich_ml/main.py component accepts an options object and passes sec...

CVE-2026-119328 Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...

nuclei-CVE-2025-24813

nuclei-CVE-2025-24813 This repository contains a yaml-template, to scan whether a Service may be vulnerable to CVE-2025-24813, without disrupting the server/causing any form of damage, using the vulnerability scanner nuclei. CVE-2025-24813 CVE-2025-24813 is a vulnerability in the Apache Tomcat...

CVE-2026-53519

Lab CVE-2026-53519 - Nezha Dashboard pre-auth path traversal Lab tai hien lo hong pre-auth path traversal via/dashboard.. prefix confusion trong Nezha Dashboard, dan toi leak jwtsecretkey - forge JWT - chiem quyen admin. Moi truong Docker, tach A/B theo version de so sanh vuln vs patched. | Image...

CVE-2026-74239

CVE-2026-74239: Windows path traversal in style archive import XenForo before 2.3.13 is vulnerable to path traversal in style archive imports on Windows. What happens The importer accepts ZIP members under upload/ and rejects names containing the forward-slash form /../. It does not normalize or...