CVE-2026-8095 Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfmdirpath parameter sanitization in the wpfmfilemetaupdate AJAX handler, where supplying WPFMDIRPATH i...

turso-cli persists Turso platform JWT with world-readable (0o644) file permissions

Summary turso-cli persists the user's Turso platform JWT to settings.json using Viper's default configPermissions of 0o644, leaving the credential file world-readable on standard Linux and macOS systems. Any other local UID on the host can read the file and recover the platform JWT, which grants...

ROS-20260624-73-0043

The vulnerability in python-aiohttp is related to an incorrect restriction on the path name of the directory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

GHSA-WC84-J36W-PW4X OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots

Summary Workspace .env STATEDIRECTORY could influence bundled runtime dependency roots. In affected versions, a workspace .env in a repository opened by a trusted operator could set STATEDIRECTORY before runtime dependency root resolution. This advisory is scoped to the named feature and...

The vulnerability of the web container of SAP NetWeaver Java Application Server allows a perpetrator to gain unauthorized access to modify confidential information or cause service failures.

The vulnerability of web containers in SAP NetWeaver Java Application Servers is related to incorrect path name restrictions for directories. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information or cause service failures by sending specially...

CVE-2025-24268

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data...

CVE-2025-24268

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data...

CVE-2025-24268

A path traversal vulnerability exists in macOS Sequoia versions prior to 15.4 due to a parsing issue in the handling of directory paths. This flaw could allow an application to bypass restrictions and access sensitive user data . The issue is resolved in macOS Sequoia 15.4 through the implementat...

CVE-2025-24268

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data...

MAL-2026-5416 Malicious code in @klapp-otp/routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9246974efd1a626094dd3f2027df2e8f1468ce45ebcba42e5207a06c5c9e16ee On npm install, this package auto-executes index.js via the preinstall lifecycle hook. The script collects os.hostname, os.userInfo, dirname,...

The vulnerability of the get_abs_path() function in the framework for creating AI agents, Agent Zero, allows a hacker to read arbitrary files.

The vulnerability of the getabspath function in the framework used to create AI agents like Agent Zero is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files...

ROS-20260608-73-0015

The vulnerability of the .NET Core software platform is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

CVE-2026-5525

A stack-based buffer overflow vulnerability exists in Notepad++ version 8.9.3 in the file drop handler component. When a user drags and drops a directory path of exactly 259 characters without a trailing backslash, the application appends a backslash and null terminator without proper bounds...

The vulnerability of the UniFi OS Server network management center arises from incorrect restrictions on the path to the directory, allowing unauthorized access by intruders to protected information.

The vulnerability of the UniFi OS Server network management center is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

CVE-2026-46724

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences...

EUVD-2026-33965

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside...

CVE-2026-45554

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside...

CVE-2022-4991

The Tychon terminal security analysis and management platform is vulnerable to privilege escalation on Windows systems. The flaw exists within an OpenSSL component where the OPENSSLDIR variable points to a subdirectory controllable by an unprivileged user. A malicious actor can place a specially-...

The vulnerability of the Poetry dependency manager in the Python programming language arises from incorrect restrictions on path names in the directory structure. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Poetry dependency manager in the Python programming language is related to incorrect restrictions on the path name to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CVE-2025-69600

RayVentory Scan Engine versions 12.6 Update 8 and previous are vulnerable to command injection in the rvia component. The root cause is the improper neutralization of special elements used in system calls, where the application fails to sanitize inputs passed directly to specific options. Attacke...