EUVD-2026-78798

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

EUVD-2026-78781

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-87791

A path traversal vulnerability in the reserved_file_check function of functions.php in the WordPress Design SCUOLE Italia theme (versions 2.6.0–2.18.1 ) allows an unauthenticated attacker to download arbitrary files accessible by the web server process. The CVSS 4.0 base score is 8.7 (HIGH) , ref...

CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-63696

Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution...

CVE-2026-91771

A flaw was found in Weights & Biases wandb. This vulnerability allows attackers controlling the backend to supply file names with directory traversal sequences during file download operations. This can lead to writing files outside the intended download directory, potentially enabling arbitrary...

CVE-2026-91771

Weights & Biases wandb (Python SDK) before 0.29.0 is affected by a path traversal vulnerability in the File.download function. The function fails to validate file names received from server responses, allowing an attacker who controls the W&B backend to supply file names containing directory trav...

EUVD-2026-78167

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

PT-2026-92389

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

CVE-2026-81568: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - j2commerce.com - Arbitrary file read via task=download in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - J2StoreModelOrderdownloads::getFilePath built the on-disk path to a purchased digital download by concatenating the configured attachment folder with the product file's...

PT-2026-91771

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

CVE-2026-83131: Improper Access Control

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: File download. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

PT-2026-92655

Name of the Vulnerable Software and Affected Versions Oracle Web Applications Desktop Integrator versions 12.2.3 through 12.2.15 Description A flaw in the File download component allows a low privileged attacker with network access via HTTPS to compromise the system. This issue can lead to...

PT-2026-92044

Name of the Vulnerable Software and Affected Versions WordPress Design Scuole Italia theme affected versions not specified Description A path traversal issue exists in the reserved file check function within the functions.php file. This flaw allows an unauthenticated attacker to download arbitrar...

CVE-2026-87791: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-70755: Improper Access Control

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: File download. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle W...

PT-2026-92479

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: File download. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle W...