CVE-2026-28167

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

EUVD-2026-64796

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167

CVE-2026-28167 is an unauthenticated arbitrary file download vulnerability in the WordPress Super Forms plugin affecting versions 6.3.315 and below . The flaw allows a remote attacker to download arbitrary files from the server without authentication, leading to a high confidentiality impact (CVS...

CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

CVE-2026-28167 WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

WordPress Super Forms plugin <= 6.3.315 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by VanTastic in WordPress Plugin Super Forms versions = 6.3.315...

CVE-2026-78212 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files...

PT-2026-80922

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated users can read arbitrary files by providing crafted filenames containing directory traversal sequences to the export download endpoint. By manipulating the filename parameter, an...

CVE-2026-77914: Improper Limitation of a Pathname to a Restricted Directory

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-76847: Missing Authorization

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-28167: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

PT-2026-80829

Unauthenticated Arbitrary File Download in Super Forms = 6.3.315 versions...

PT-2026-85361

Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as ../../escaped.txt can cause a downloaded file to be created outside the user-selected destination directory. Details In the remote download master transfer path, Cloudreve joins th...

Exploit for CVE-2026-66916

Password-Protected Category Bypass via JSON Format in JoomGall...

EUVD-2026-64603

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-76607

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

EUVD-2026-64319

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.3 - ???...

CVE-2026-76607 Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik 4.7.2...

CVE-2026-76607

Fabrik , a Joomla extension by fabrikar.com, is vulnerable to a missing ACL (Access Control List) check in its download element in versions prior to 4.7.3 . This flaw allows unauthenticated remote attackers to access download functionality without proper authorization, leading to high impact on c...