CVE-2026-65889

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-65889

Joomla extension Gridbox (balbooa.com) for

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-65889 Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

EUVD-2026-50334

Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion 2.20.2 - The generateNewApp method allows actors to recursively delete directories...

CVE-2026-14490

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-14490 Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-14490

The CVE concerns the Demi – One Click Demo Import, WP Backup & Site Migration WordPress plugin. All versions up to 0.0.7 are affected due to the plugin storing its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible uploads subdirectory without protection. The una...

CVE-2026-14490

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

EUVD-2026-49692

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

CVE-2026-15457

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

CVE-2026-15457 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.0.13 via the 'family' parameter. This makes it possible for authenticated attackers, with editor-level access and above, to delete...

PYSEC-2026-2420 CloakBrowser: Unauthenticated path traversal via fingerprint parameter in cloakserve leads to arbitrary directory deletion

The cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakserve port can supply a crafted fingerprint value containing path traversal...

GHSA-89P7-7CQ3-HHR2 rm: 'rm -rf ./' (and ./// variants) silently deletes current directory contents, bypassing dot protection

rm -rf . is correctly refused, but cleantrailingslashes normalizes ./// to ./ while pathiscurrentorparentdirectory only matches ./.. and /.//.., not ./ or ../. So rm -rf ./ recursively deletes the directory's contents and then prints a misleading cannot remove './': Invalid input. Impact: all...

CVE-2026-55699

A flaw was found in pnpm, a package manager. When a malicious package with specially crafted manifest bin object keys such as "." or ".." is installed globally, subsequent package management operations like removal, update, or replacement could lead to the deletion of critical directories. This...

GO-2026-5459 Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery

Anyquery has Path Traversal through clearplugincache, Allowing Arbitrary Directory Deletion in github.com/julien040/anyquery. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

MAL-2026-5550 Malicious code in @my_name_is_khn/express-security-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7e17fc1e874d13547ace24c7b21593ce1eb13337d0d877a89c7a372974ee42 On npm install, the package's postinstall hook scripts/inject.js locates the installer's host project root, identifies the main entry file index.js,...

Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion

Path Traversal in clearplugincache Allows Arbitrary Directory Deletion | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 | | Vulnerability | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory | | Severity | High | Summa...