CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-64872

The CVE-2026-64872 entry concerns a Joomla extension from regularlabs.com, specifically the Cache Cleaner Pro extension. The vulnerability is a path traversal issue where custom purge and log paths could escape the site webroot directory. Documents consistently reference this path traversal flaw ...

CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

CVE-2026-65431 Joomla Extension - regularlabs.com - Zipslip in GeoIP extension

Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions...

Exploit for Path Traversal in Jugmac00 Flask-Reuploaded

CVE-2026-27641 is a critical security vulnerability affecting ve...

@darthcav/ts-http-server (0.9.1), @digitalpaws/starr (0.0.2) +4 more potentially affected by CVE-2026-15074 via @fastify/static (10.1.0)

@fastify/static NPM version 10.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/static and may be impacted: - @darthcav/ts-http-server 0.9.1 - @digitalpaws/starr 0.0.2 - @node-cli/static-server =3.1.17, =9.0.0-canary.19, =9.0.2 Source cves:...

CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

CVE-2026-15074 @fastify/static vulnerable to route guard bypass via path traversal

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot...

CVE-2026-16653

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

EUVD-2026-47867

A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...

CVE-2026-16653

CVE-2026-16653 concerns boazsegev facil.io up to version 0.7.58. The vulnerability affects the Public Folder Handler, specifically the http_sendfile2 function in lib/facil/http/http.c, where manipulation allows path traversal. Remote exploitation is possible and the exploit has been released publ...

PT-2026-64000

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the file upload functionality within the DataHub module. Authenticated attackers can use a crafted filename to perfo...

PT-2026-64194

Name of the Vulnerable Software and Affected Versions Ne-Lexa php-zip versions prior to 4.0.3 Description A path traversal issue exists in the ZIP Handler component within the ZipFile::extractTo function located in the src/ZipFile.php file. A remote attacker can exploit this by manipulating the...

PT-2026-63973

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description An authenticated attacker can exploit a path traversal issue in the /export/temp/ endpoint within the serveExport handler located in kernel/server/serve.go. The vulnerability exists because the...

PT-2026-63999

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the database download feature within the DataHub module. This path traversal weakness allows unauthenticated attacke...

PT-2026-63997

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the SVG processing feature within the DataHub module. This path traversal weakness allows unauthenticated attackers ...