Cisco Nexus Dashboard Insights 路径遍历漏洞

Cisco Nexus Dashboard Insights is a data center network operation analysis and fault diagnosis platform developed by the American company Cisco. Cisco Nexus Dashboard Insights has a path traversal vulnerability, which stems from insufficient validation of metadata update files. This vulnerability...

PT-2026-29564

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote attacker to write arbitrary files to an affected system. This vulnerability is due to insufficient validation of the metadata update file. An attacker could exploit this...

PT-2026-29515

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled pat...

CVE-2026-31831

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has be...

PYSEC-2026-2193

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an...

UBUNTU-CVE-2026-34036

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. In versions 22.0.4 and prior, there is a Local File Inclusion LFI vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting...

CVE-2026-34070 LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an...

CVE-2026-34070

CVE-2026-34070 affects LangChain Core prior to 1.2.22, where multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injections. An attacker could read arbitrary host files whe...

CVE-2026-34036

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. In versions 22.0.4 and prior, there is a Local File Inclusion LFI vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting...

OpenClaw Path Traversal Vulnerability (CNVD-2026-16040)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from a path traversal vulnerability that can be exploited by an attacker to read arbitrary files and disclose sensitive information...

Rareprob Video player 安全漏洞

Rareprob Video Player is a mobile video player application developed by the Indian company Rareprob. It supports playback of videos in multiple formats and local media management. Version 1.0.135 of Rareprob Video Player contains a security vulnerability. This vulnerability stems from an issue...

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the mediaUrl or fileUrl parameter keys, which are not properly normalized in the relevant process. An attacker can access sensitive files belonging to other agents...

Directory Traversal

Overview @tinacms/graphql is a GraphQL database generating component for Tina, the headless content management system with support for Markdown, MDX, JSON, YAML, and more. Affected versions of this package are vulnerable to Directory Traversal due to improper validation of backslashes on...

CVE-2026-33531

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: encodesvgimage, asset, and...

Improper Neutralization of Special Elements Used in a Template Engine

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine through improper implementation of the chroot isolation mechanism in the pongo2 template processing. An attacker can gain unauthorized access to read and write...

Open WebUI has unauthorized deletion of knowledge files

Summary An access control check is missing when deleting a file from a knowledge base. The only check being done is that the user has write access to the knowledge base or is admin, but NOT that the file actually belongs to this knowledge base. It is thus possible to delete arbitrary files from...

CVE-2026-33206 calibre has a path traversal vulnerability

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.6.0, a path traversal vulnerability exists in Calibre' handling of images in Markdown and other similar text-based files allowing an attacker to include arbitrary files from the...

CVE-2026-4619

CVE-2026-4619 concerns a path traversal vulnerability in NEC Platforms, Ltd. Aterm Series. Multiple sources confirm that an attacker can overwrite arbitrary files over the network, via the affected device’s web/management interfaces. The issue is associated with the NEC Aterm family, and is liste...

Awesome LLM Apps 安全漏洞

Awesome LLM Apps is a collection of large language model applications personally developed by Shubham Saboo. Awesome LLM Apps contains a security vulnerability, which stems from the stream-audio endpoint not properly verifying user-controlled path parameters. This could allow unverified remote...

Metabase 代码问题漏洞

Metabase is an open-source data analysis platform developed by the American company Metabase. Code vulnerabilities existed in versions of Metabase Enterprise prior to 1.54.22, 1.55.22, 1.56.22, 1.57.16, 1.58.10, and 1.59.4. These vulnerabilities stemmed from deserialization attacks at the...