CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75830

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-15585

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

EUVD-2026-60617

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-15585 Path Traversal in AKIN Software's Wolvox9 ERP

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 befo...

CVE-2026-15585

A Path Traversal flaw in AKINSOFT Wolvox9 ERP's KontrolPanel.exe (versions s26.02.17 up to before 26.02.22) allows unauthenticated remote attackers to read arbitrary files. CVSS 7.5 (HIGH) reflects network-exploitable, high-confidentiality impact with no integrity or availability impact. No explo...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

EUVD-2026-60616

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855

ArcadeDB versions before 26.8.1 do not sanitize database names in the POST /api/v1/server endpoint, allowing authenticated root users to supply ../ sequences for arbitrary file creation or recursive directory deletion. CVSS 8.7 HIGH; exploitation details not provided. Remediation is to upgrade to...

EUVD-2026-60594

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75830 grav-plugin-api before 1.0.15 Path Traversal via batchCopy

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75830

grav-plugin-api (getgrav/grav-plugin-api) versions 1.0.0-beta.10 through 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for a prior advisory (GHSA-qjq4-jp55-4mx2) left the user-controlled suffix parameter in POST /api/v1/pages/batch unv...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

EUVD-2026-60588

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907

Grav before 2.0.15 uses string prefix matching instead of directory-boundary validation in the static asset server (index.php), allowing unauthenticated attackers to access sibling-directory files by requesting paths like assets-secret when assets is the base. Upgrade to Grav 2.0.15 or later to r...

CVE-2026-75627

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...