CVE-2026-62865 TypeBot: Arbitrary server file read via Send Email block attachment path

Typebot is an open-source chatbot builder. In self-hosted versions prior to 3.18.0, the server-side Send Email integration block allows arbitrary reading of local files on the server. The block builds Nodemailer attachments from a typebot variable, and its parseAttachments helper returns the...

CVE-2026-62865

Typebot (open-source chatbot builder), in self-hosted versions prior to 3.18.0 , allows arbitrary local file read through the server-side Send Email integration block. The parseAttachments helper treats any attachment value not matching the application's base URL as a filesystem path, and the Nod...

CVE-2025-10307

Exploit: Cancellazione di file arbitraria tramite Backuply tarfile path traversal PoC da console del browser admin autenticato root@kitploit: async = const page = $location.origin/wordpress/wp-admin/admin.php?page=backuply; // 1 Extract a valid nonce from the Backuply page const html = await...

CVE-2026-80104

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-65092

NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637

Velero is an open-source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1 , a file path traversal vulnerability exists during restore: an attacker who compromises the backup object-storage backend can upload a malicious tarball con...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

EUVD-2026-66108

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104

DB-GPT 0.8.0 is affected by a path traversal vulnerability in the skill_upload endpoint (in agentic_data_api.py). The function constructs the destination path using the multipart filename directly via the / operator without canonicalization or a containment check under the upload directory. An ab...

CVE-2026-66152

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root...

CVE-2026-65092

NVIDIA OpenShell Sandbox for Linux is affected by a path traversal vulnerability that allows bypassing its L7 REST network policy . An attacker with network access and low privileges can exploit this to achieve information disclosure and data tampering . The CVSS v3.1 base score is 8.5 (HIGH) , w...

EUVD-2026-66091

NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-65092

NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

Grafana-Password-Decryptor

Decifratore di Password Grafana Toolkit Python per decifrare e craccare le password di Grafana da più formati. Realizzato da: strikoder Cosa Fa Questo Strumento? Gestisce due tipi di archiviazione delle password di Grafana: 🔐 AES-256 Base64 tabella datasource → Decifra direttamente con...

CVE-2026-66152

CVE-2026-66152 is a path traversal vulnerability (CWE-29) in the OPSWAT tarball component of the SonicWall NetExtender Linux client , allowing an attacker to write an arbitrary file as root . The attack vector is network-based with low complexity and no required privileges , though user interacti...

CVE-2026-66152

A Path traversal vulnerability in OPSWAT tarball in the SonicWall NetExtender Linux client allows an attacker to write arbitrary file as root...

GO-2026-6259 Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero

Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero...