CVE-2026-46711

In Soft Machine versions 0.2.247 and prior , the workspace HTTP service listening on 0.0.0.0:8080 within sm-ws- Fly Machines * lacks authentication and origin checks. This vulnerability allows any host capable of reaching TCP/8080 to access endpoints such as /health, /file/, and /archive/. Conseq...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-46711 Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

EUVD-2026-90085

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

CVE-2026-103398

The software OpenSave through 2.4.0 is vulnerable to an arbitrary file read and write flaw. The issue originates in the manifest request handler , which fails to properly validate save paths provided by paired peers. This allows an attacker to specify arbitrary directories outside of the configur...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

CVE-2026-102457

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files...

CVE-2026-102457 DigiWin｜EasyFlow .NET - Arbitrary File Read

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files...

CVE-2026-102457

The software EasyFlow .NET developed by DigiWin is vulnerable to an Arbitrary File Read vulnerability. This flaw allows authenticated remote attackers to exploit the system to download arbitrary system files . No specific root cause, affected versions, or remediation details are provided in the d...

EUVD-2026-89713

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files...

CVE-2026-102457 DigiWin｜EasyFlow .NET - Arbitrary File Read

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

EUVD-2026-89684

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-75098

The Product Designer App plugin for WordPress (versions up to and including 1.1.3 ) is vulnerable to an unauthenticated arbitrary file read via a Directory Traversal flaw in the svg parameter. An attacker can exploit this by obtaining a nonce and token, which are publicly emitted as JavaScript gl...

CVE-2026-97150

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

WordPress Product Designer App plugin <= 1.1.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin Product Designer App versions = 1.1.3...

CVE-2026-97150

The BcAddonMigrator plugin in baserCMS (provided by baserCMS Users Community) is vulnerable to an Inclusion of Functionality from Untrusted Control Sphere (CWE-829). During the conversion of baserCMS4-style addons to baserCMS5-style ones, the BcAddonMigrator incorrectly includes the config.php fi...