CVE-2026-121371

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem...

CVE-2026-115483

The Everest Forms plugin for WordPress (versions up to and including 3.6.3 ) is vulnerable to an Unauthenticated Arbitrary File Read via the attach_entry_files() function. The root cause is that the function attaches any entry field value whose meta key matches /signature_/ to notification emails...

checker-CVE-2020-5902

Checker CVE-2020-5902 Checker CVE-2020-5902: BIG-IP versions 15.0.0 through 15.1.0.3, 14.1.0 through 14.1.2.5, 13.1.0 through 13.1.3.3, 12.1.0 through 12.1.5.1, and 11.6.1 through 11.6.5.1 suffer from Traffic Management User Interface TMUI arbitrary file read and command execution vulnerabilities...

CVE-2026-97881

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...

GHSA-5M6C-38R8-5W76 Dagu MCP DAG specification read bypasses path containment and workspace isolation

Summary The traversal fix for CVE-2026-33344 was implemented as HTTP middleware installed only in the chi handler chain, but the MCP service calls the same API method in process, so arbitrary YAML file read is reachable again through the MCP tool surface with a viewer-role key. Read-only, limited...

EUVD-2026-121260

The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted...

CVE-2026-86811

The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...

Enlogic SCADA Virtual Controller Path Traversal

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability allows a malicious actor to read and write arbitrary files...

CVE-2026-125672

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a...

CVE-2026-125672 Cockpit: cockpit-storaged: tang keyserver address from an untrusted luks header clevis token reaches curl's argument vector as an option

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a...

CVE-2026-125672

A flaw in cockpit-storaged allows for curl option injection because a Tang keyserver address read from an untrusted clevis token in a LUKS header is concatenated into a curl argument vector without a "--" separator. If an attacker attaches a crafted LUKS/clevis block device, they can trick an adm...

EUVD-2026-120869

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a...

CVE-2026-125672

A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a...

WordPress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin <= 3.6.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Maciej Komorowski in WordPress Plugin Everest Forms versions = 3.6.3...

ROOT-APP-PYPI-GHSA-4GMW-GG2M-W46P GHSA-4gmw-gg2m-w46p in GitPython - Patched by Root

Root has patched GHSA-4gmw-gg2m-w46p in the GitPython package for Root:PyPI. Multiple fixed versions available...

CVE-2026-100386 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7wpcf7mailcomponents function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which c...

Audiobookshelf - Authentication Bypass

Audiobookshelf contains a path traversal caused by improper authentication-exemption check on URL-encoded paths in server/routers/Auth.js, letting unauthenticated attackers read arbitrary files, exploit requires crafted URL with encoded traversal sequences. id: CVE-2026-71209 info: name:...

Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read

Microweber CMS = 2.0.20 contains a path traversal vulnerability caused by failure to normalize path query parameter in static file controller, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-65694 info: name: Microweber CMS = 2.0.20 - Unauthenticated Arbitrary File Rea...

Lightdash version <= 0.510.3 Arbitrary File Read

packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory traversal and do not ensure that an intended file extension .csv or .png is used. id: CVE-2023-35844 info: name: Lightdash version = 0.510.3 Arbitrary File Read author: dwisiswant0...

CrateDB Database - Arbitrary File Read

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY...