CVE-2026-17614

CVE-2026-17614 affects WildFly-core in domain mode. The LocalFileRepository.getFile() and getConfigurationFile() do not ensure that resolved paths stay within the configured repository or configuration root, enabling a path traversal via crafted relative paths (e.g., ../../etc/passwd) sent throug...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-56845

The CVE describes an unauthenticated Local File Inclusion (LFI) vulnerability under /custom-sounds/ when CustomSounds storage uses FileSystem. An attacker can use ../ sequences in the request path to read arbitrary files outside the base directory. Documented impact is reading sensitive files; no...

CVE-2026-56845

An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...

CVE-2026-69153 PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile to read an unintended source-map file by supplying an absolute or directory-traversal...

EUVD-2026-52282

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark, which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource. Because the file:// scheme branch only lexically collapses '..' segments without a...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

CVE-2026-4793

CVE-2026-4793 affects Synology Assistant prior to 7.0.7-50095. The issue is an incorrect default permissions vulnerability that lets local users read or write arbitrary files and can cause a denial-of-service during installation. Affected component: Synology Assistant (client-side utility) with l...

CVE-2025-15673

The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server...

GHSA-VVP7-H4FJ-M28W FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Summary The subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed...

Information Exposure

Overview gemini-bridge is a Lightweight MCP server bridging Claude Code to Google's Gemini AI via official CLI Affected versions of this package are vulnerable to Information Exposure via the consultgeminiwithfiles process in inline mode, which reads file paths supplied in the files argument...

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories

A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...

abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories

A time-of-check time-of-use TOCTOU race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package...

OPENSUSE-SU-2026:21506-1 Security update for spice-vdagent

This update for spice-vdagent fixes the following issues: - CVE-2026-57965: integer overflow in udscswrite allows a compromised SPICE host to crash the spice-vdagent daemon via a specially crafted message that triggers a heap buffer overflow bsc1269553. - CVE-2026-57966: improper sanitization...

CVE-2026-56673 ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to 0.28.0, folderpaths.getannotatedfilepath and existsannotatedfilepath join workflow-controlled annotated filenames to a base directory without a containment check, allowing an unauthenticated craft...

CVE-2026-66415 Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-12942

Langflow OSS (IBM) is affected by CVE-2026-12942 due to a path traversal flaw in unauthenticated API endpoints. Versions 1.0.0–1.10.1 allow remote attackers to access arbitrary files via crafted URL paths containing /../ sequences, potentially exposing credentials and sensitive data. The issue is...

EUVD-2026-51243

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

SUSE CVE-2026-56390

GNU Bison improperly handles grammar-defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller-supplied output options. When processing attacker-supplied grammar, this behavior allows directing...