6074 matches found
EUVD-2026-107664
In Splunk Enterprise versions below 10.4.4, a user that holds a role with the previewdatamanagementpipeline capability or editdatamanagementpipelinejob capability could read or delete Data Management SPL2 preview jobs and results outside their ownership scope. The vulnerability is possible becaus...
DRUPAL-CONTRIB-2026-231
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...
GHSA-F2PH-CMG5-WXC8 Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Summary: A malicious website may be able to cause unauthorized file changes in a developer’s project while an affected Storybook development server is running. Under additional conditions, a changed file could be executed by a local runtime with the developer’s privileges. We are not aware of...
CVE-2026-104025
A flaw was found in PeaZip. This vulnerability allows an attacker to achieve arbitrary code execution by convincing a user to preview an entry within a specially crafted archive file. Because the archive preview functionality does not properly sanitize file paths against directory traversal...
Directory Traversal
Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Directory Traversal via the vite preview server on Windows, where requests with path traversal sequences can escape the prerendered output directory and read arbitrary files accessible to t...
CVE-2026-114063
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
CVE-2026-114063
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
CVE-2026-114063
SvelteKit (@sveltejs/kit) versions 2.10.0 before 3.0.0 are vulnerable to a path traversal vulnerability within the vite preview server on Windows systems. This flaw allows unauthenticated attackers with network access or a tunnel to the preview server to send crafted requests and read files outsi...
CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
EUVD-2026-107014
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
PT-2026-120908
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...
PT-2026-120189
SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...
Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231
This theme provides a front-end design for transparency and open-government sites, including a table preview of CSV files attached to content. The theme doesn't sufficiently check file access when it renders that preview. It reads the file directly, so a visitor who may view the content, but whos...
CVE-2016-20100
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...
CVE-2016-20100
The Memphis Documents Library plugin for WordPress (versions before 3.1.6 ) is vulnerable to a path traversal vulnerability. This flaw allows unauthenticated attackers to read arbitrary files by sending GET requests containing traversal sequences to the mdocs_img_preview() function in mdocs-downl...
CVE-2016-20100 Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...
EUVD-2016-10917
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocsimgpreview in mdocs-downloads.php...
