CVE-2026-59935 vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-70197

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

PT-2026-70175

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search search files tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside the configured directory, causing the tool to return the...

PT-2026-70196

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

PT-2026-70875

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in...

PT-2026-70819

Name of the Vulnerable Software and Affected Versions Lightroom Classic affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows for arbitrary file system read. This issue enables an attacker to access sensiti...

PT-2026-70103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal vulnerability exists in the Offline archives functionality of the local web interface. This issue occurs because of insufficient validation of a...

Planyo Online Reservation System 3.0 SSRF / Arbitrary File Read

Planyo Online Reservation System versions 3.0 and below suffer from an arbitrary file read vulnerability that is leveraged by a server-side request forgery flaw. Exploit Title: PlanyoOnlineReservationSystem 3.0 - Arbitrary File Read via SSRF Date: 12-07-2026 Exploit Author: Balachandar Gowrisanka...

PT-2026-70872

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

PT-2026-70055

Name of the Vulnerable Software and Affected Versions wildfly-core affected versions not specified Description A flaw allows a remote attacker with 'deployer' account authentication to import and deploy a malicious archive file from an untrusted source. By leveraging WildFly libraries to create a...

Podlove Podcast Publisher 4.5.1 Shell Upload

A proof of concept exploit for an unauthenticated arbitrary file upload vulnerability leading to remote code execution in Podlove Podcast Publisher version 4.5.1. The vulnerability uses inconsistent parsing of an attacker-controlled source URL, allowing a GIF/PHP polyglot to pass file-type...

PT-2026-70924

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

PT-2026-70252

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Description An issue known as CopyEscape allows for an arbitrary file write from a container to the host system. This occurs through the use of the docker cp command, which can be leveraged to write files...

VulnCheck KEV: CVE-2026-49049

The Helix3 plugin for Joomla exposes an ajax handler task, that allows unauthenticated attackers to delete arbitrary files, write arbitrary JSON files and update template parameters...

PT-2026-70904

『We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable,』😩 SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction CVE-2026-66145 https://t.co/hp0HOWboM9...

PT-2026-70827

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the file name form field with no path containment check. Attackers can register an...

Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

Summary A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. Impact A local user with administrative credentials for the web interface could submit an archive name containing traversal...

PT-2026-70172

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

gitea -- Multiple vulnerabilities

Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...