CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-54910

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

CVE-2026-54685

FileBrowser Quantum exposes a timing-side-channel in the /api/auth/login endpoint prior to version 1.3.2-beta, allowing unauthenticated users to distinguish valid usernames from invalid ones via response-time differences (bcrypt path for valid usernames). A PoC demonstrates the attack, and the is...

CVE-2026-54685 FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username...

CVE-2026-46410 FileBrowser Quantum: unauthenticated user share share info

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...

CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

PT-2026-61605

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.4.3-beta Description The subtitlesHandler endpoint GET /api/media/subtitles contains path traversal flaws due to insufficient sanitization of the path and name query parameters. The path parameter is...

EUVD-2026-45410

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialedexec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

CVE-2026-16199 nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialedexec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

PT-2026-60998

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This affects the function ExecTool.Execute of the file goclaw/internal/tools/credentialed exec.go. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been published...

CVE-2026-16124

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/webshared.go of the component webfetch. Such manipulation leads to server-side request forgery. The attack can be launched remotel...

CVE-2026-16124 nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/webshared.go of the component webfetch. Such manipulation leads to server-side request forgery. The attack can be launched remotel...

EUVD-2026-45385

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/webshared.go of the component webfetch. Such manipulation leads to server-side request forgery. The attack can be launched remotel...

CVE-2026-16120

CVE-2026-16120 affects nextlevelbuilder GoClaw up to version 3.13.3-beta.3. The vulnerability targets the function matchesAllowlist/extractBin in internal/tools/exec_approval.go, where manipulation can cause an incorrectly-resolved name. The attack can be performed remotely, and public exploitati...

PT-2026-60971

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web shared.go of the component web fetch. Such manipulation leads to server-side request forgery. The attack can be launched...

EUVD-2026-44939

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader...

EUVD-2026-44940

Prompty: Arbitrary file read via file reference expansion...

CVE-2026-62217

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing...