CVE-2026-110108

A flaw was found in MateCloud. Administrative object storage endpoints lack proper access control, allowing any authenticated user to perform restricted storage operations. A remote authenticated user with low privileges can exploit this vulnerability to list stored objects, download files...

CVE-2026-54381

VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessible bucket containing 129,947 objects, including 126,881...

CVE-2026-54381

The VitaFit cloud API (versions prior to 2026-10-30 ) is vulnerable to an unauthenticated information disclosure due to a misconfigured cloud storage bucket . This flaw allows attackers to list and download files without any credentials, potentially exposing sensitive personal data. Specifically,...

PT-2026-137215

Name of the Vulnerable Software and Affected Versions VitaFit cloud API versions prior to 2026-10-30 Description A misconfigured cloud storage bucket allows unauthenticated attackers to list and download stored files. This issue enables the enumeration of a publicly accessible bucket containing...

CLEANSTART-2026-DD03194 ftp and scp tasks of Apache Ant can download files from a remote server

Security vulnerability affects the rundeck package. The ftp and scp tasks of Apache Ant can download files from a remote server...

CVE-2026-111646

SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/attachmentId. Attackers who know or derive time-ordered snowflake file ids can bypass shared, owner, and project checks i...

CVE-2026-17542

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...

EUVD-2026-55039

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...

CVE-2026-66914 Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

Amazon S3 Torrent Download - Detect

Amazon S3 Torrent download was detected, which can allow a malicious user to download files. !/usr/bin/env python3 -- coding: utf-8 -- """Amazon S3 Torrent download was detected, which can allow a malicious user to download files.""" from kittysploit import from lib.protocols.http.httpclient impo...

CVE-2026-34024

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable. This allow...

EUVD-2026-36709

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation,...

CVE-2026-34024 Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable. This allow...

PT-2026-49195

Name of the Vulnerable Software and Affected Versions Wertheim SafeController Software version 6.15.8328.28014 Description Missing authorization checks on multiple web application endpoints allow an authenticated attacker with minimal privileges to access hidden endpoints. This enables the...

PT-2026-45121

Open STA Manager 2.3 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by manipulating the file parameter. Attackers can send GET requests to modules/backup/actions.php with op=getfile and traverse directories using ../ sequences to access sensiti...

Interinfo DreamMaker security vulnerabilities

Interinfo DreamMaker is an application developed by Interinfo Corporation in China. Interinfo DreamMaker has a security vulnerability, which stems from relative path traversal. This vulnerability could allow privileged local attackers to download arbitrary system files...

EUVD-2026-31429

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate file ownership and access control, which allows an authenticated user to access and download files belonging to other users or teams via crafted Boards API requests using valid file IDs...

F5 BIG-IP security vulnerabilities

F5 BIG-IP is an application delivery platform developed by F5 Technologies in the United States. It integrates functions such as network traffic management, application security management, and load balancing. F5 BIG-IP has a security vulnerability that stems from allowing authenticated attackers...

CVE-2026-20078

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. These vulnerabilities are due to improper sanitization o...