CVE-2026-64872 Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

EUVD-2026-47912

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via non-canonical URL path handling in the allowedPath check in index.js. An attacker can bypass file/subtr...

CVE-2026-7120

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

CVE-2026-7120

The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...

CVE-2026-7120 @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for file resolution. Versions up to and including 10.1.1 are affected. An unauthenticated attacker can bypass allowedPath restrictions by requesting equivalent...

SUSE CVE-2026-53632

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the...

danger allows local OS command injection through crafted file paths

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

GHSA-3X93-P86W-5JVH danger allows local OS command injection through crafted file paths

A vulnerability was identified in danger danger-js up to 13.0.7. Impacted is the function danger.git.diffForFile of the file source/platforms/git/localGetFileAtSHA.ts of the component CLI. Such manipulation of the argument File leads to os command injection. The attack needs to be performed...

PT-2026-63610

Modals gallery paths could enumerate unintended directories...

PT-2026-64215

Name of the Vulnerable Software and Affected Versions React Router versions 6.0.0 through 7.17.0 Description An open redirect issue exists where the use of backslashes in the component and the useNavigate function can lead to unexpected external navigations when attacker-supplied paths are...

PT-2026-64026

Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute...

PT-2026-63611

ReReplacer XML include paths could read files outside the site directory...

PT-2026-63609

CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

PT-2026-63567

Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.2 Description An unauthenticated attacker can bypass path-based filtering because the allowedPath callback is evaluated before the normalization of dot segments and duplicate path separators in the pathna...

PT-2026-64138

Summary Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to t...

CVE-2026-64872: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory...

CVE-2026-65754: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

PT-2026-63602

Custom purge and log paths could escape the site webroot directory...

CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...