EUVD-2026-45127

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheetexporttmpname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files ...

CVE-2026-15160

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheetexporttmpname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files ...

CVE-2026-15160

Summary of CVE-2026-15160 : The Ninja Forms - Excel Export plugin for WordPress is vulnerable to a directory traversal flaw in all versions up to and including 3.3.6, exploitable via the spreadsheet_export_tmp_name parameter. This vulnerability allows an authenticated user with subscriber-level a...

CVE-2026-36669

CVE-2026-36669 affects Feng Office 3.11.13.11, targeting the ck_upload_handler.php component. The vulnerability is an unauthenticated arbitrary file upload that allows attackers to place files (e.g., .html) in the web-accessible /tmp directory. Reported CVSS v3.1: 9.8 (CRITICAL) with network atta...

CVE-2026-36669

An unauthenticated arbitrary file upload vulnerability in ckuploadhandler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files such as .html to the web-accessible /tmp/ directory...

PT-2026-60862

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An authenticated attacker can read arbitrary files, including the JWT signing key. This allows the attacker to forge authentication tokens for any user. JWT JSON Web Token is a compact...

PT-2026-60858

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An authenticated attacker can create a malicious flow that points to a URL under their control. By returning a specially crafted Content-Disposition header, such as...

Security update for opam (important)

openSUSE Security Update: Security update for opam Announcement ID: openSUSE-SU-2026:0250-1 Rating: important References: Cross-References: CVE-2026-57825 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for opam...

CVE-2026-53535

Activepieces prior to 0.82.0 is affected by an arbitrary file write in the git-sync workflow. The issue occurs because git-sync clones a configured repository into a temporary server directory with Git’s symbolic-link handling enabled, allowing symlinks to redirect writes. Additionally, on-disk i...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53535 Activepieces: Arbitrary file write in git-sync via path traversal and symlinks

Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on the server and then writes flow, table, and connection state into it before pushing back, and two separate weaknesses allowed...

CVE-2026-53598 Prompty: Arbitrary File Read via ${file:path} Reference Expansion

Prompty is a markdown file format .prompty for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded $file:... references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read...

CVE-2026-59866

Kiota (OpenAPI-based HTTP client generator) is affected by CVE-2026-59866 due to unsafe generation of x-ms-kiota-info clientClassName and clientNamespaceName, which can cause arbitrary file writes and code-injection when kiota generate runs without -c/--class-name. The issue allows attacker-contr...

CVE-2026-59866 Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota generate ra...

Path Traversal

github.com/eat-pray-ai/yutu is vulnerable to Path Traversal. The vulnerability is due to the caption-download MCP tool passing a caller-controlled file path directly to os.Create without path validation, canonicalization, or restriction to the YUTUROOT directory, which allows an attacker to write...

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

CVE-2026-15008

The CVE concerns The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin for WordPress. All versions up to and including 7.3.1.4 are affected by an arbitrary file deletion vulnerability caused by insufficient file path validation in the fr_token function, enabling...

CVE-2026-15008 Uncanny Automator <= 7.3.1.4 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the frtoken function in all versions up to, and including, 7.3.1.4. This makes it possible for...

JetBrains TeamCity < 2026.1.2 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2026.1.2. It is, therefore, affected by multiple vulnerabilities, including: - Arbitrary file access was possible via the Perforce VCS integration. CVE-2026-59793 - Stored XSS via unauthenticated agent registration was...

CVE-2026-52890

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method with attacker-controlled versions.original.path and versions.original.storage fields. The server/permissions/attachments....