PT-2026-78235

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.5.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The downloadSubtitleFile function in src/ipc/downloads.js, accessed via the run-download IPC...

PT-2026-77165

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The image analyze tool fails to canonicalize symlinks before reading files, leading to a path traversal issue. This allows attackers to create workspace symlinks that point to external files with...

PT-2026-77251

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...

Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2066)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2066 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM attackers to create root-owned files outside the database and...

Amazon Linux 2 : iscsi-initiator-utils, --advisory ALAS2-2026-3867 (ALAS-2026-3867)

The version of iscsi-initiator-utils installed on the remote host is prior to 6.2.0.874-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3867 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-...

GHSA-GQCH-G4W5-7QCW MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...

CVE-2026-75482

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-54336

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

EUVD-2026-60470

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518

Typemill before 2.26.0 has an authorization bypass in the media file download route: the restriction check keys on the raw, un-normalized request path ($restrictions['media/files/' . $args['params']]) while file_get_contents($base . $params) resolves via the OS-normalized path. Since validate() o...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-54336

JumpServer (open source bastion host and O&M security audit system) is affected by a path traversal vulnerability in the KoKo Web Terminal SFTP feature (versions 4.8.0 through 4.10.17). An authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths that cause...

CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-40506

OpenEMR before 8.2.0 is vulnerable: the db GET parameter in standard_tables_manage.php is passed unsanitized to temp_dir_cleanup(), allowing path traversal and recursive deletion of arbitrary directories. Chaining with an open redirect in dicom_frame.php enables an unauthenticated attacker to tri...