CVE-2026-116240: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which…

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

PT-2026-133625

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2010-20125: DedeCMS: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requireonce. Attackers can supply path traversal sequences ../../ to include...

CVE-2026-119979: Element Labs LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that…

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository...

CVE-2026-119333: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.io

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with checkaccesspermission and then opened it by name. Several places opened it with a plain open or handed the path to a utility that opened it later: the servers.json export and import and the import fi...

PT-2026-133524

CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Every CallBackery application mounts its documentation plugin at /doc, ahead of any session check. The route passes the requested name to Pod::Simple::Search-find...

VulnCheck KEV: CVE-2023-2356

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

PT-2026-133523

HTTP::Parser::XS versions before 0.18 for Perl truncate PATH INFO at an encoded NUL byte in parse http request. The XS parser URL-decodes the request path and measures the result with strlen, so PATH INFO ends at the first byte decoded from %00. The pure-Perl backend is not affected. A remote...

PT-2026-133610

Name of the Vulnerable Software and Affected Versions SOCFortress CoPilot versions prior to 0.1.77 Description The application allows admin and analyst users to upload content via the 'POST /api/scoutsuite/generate-gcp-report' endpoint. The system validates the content as GCPScoutSuiteJSON but...

CVE-2026-61738: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, POST /api/scoutsuite/generate-gcp-report in backend/app/integrations/scoutsuite/routes/scoutsuite.py admits admin and analyst users and validates the uploaded content as...

PT-2026-134170

draw.io Desktop is the official Electron build of draw.io. Prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name from src/main/electron.js. When draw.io Desktop was not already running, opening a diagram from File Explorer made the diagram directory the...

CVE-2026-63338: inex IXP-Manager: IXP Manager is a full-stack web application for managing Internet Exchange Points

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without...

Linux Distros Unpatched Vulnerability : CVE-2026-118242

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object...

Linux Distros Unpatched Vulnerability : CVE-2026-119130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path- with-query values in wasmtime-wasi-http are paths, so...

astro-notion-blog 0.13.0 Path Traversal / Remote Code Execution

astro-notion-blog version 0.13.0 allows Notion database editors to supply an encoded FeaturedImage filename that escapes the image directory during site builds, overwrites an Astro page, and enables code execution as the build user. https://packetstorm.news/download/238545...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

nodejs: nodejs: Permission model bypass via wildcard path matching flaw

A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example,...

GitPython: GitPython: Arbitrary Code Execution via Path Traversal

A flaw was found in GitPython. This vulnerability allows a remote attacker to create arbitrary Git directories outside the intended clone destination. By manipulating the separategitdir parameter during repository cloning, an attacker can redirect repository metadata to an attacker-controlled...