CVE-2026-47661

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47661 Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47661

Pathling Server prior to 2.0.0 is vulnerable in the /$result endpoint: an attacker with a valid async export job ID can supply file parameters with path traversal sequences. The handler only validates the supplied job and does not normalise or confine the requested file path to the job’s director...

CVE-2026-47659 Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47659

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

CVE-2026-47659

Pathling Server prior to 2.0.0 exposes a path traversal vulnerability in the /$result endpoint. An attacker who can obtain a valid async export job ID can supply file parameters containing traversal sequences and the handler only validates the job ID, not the file path, allowing reads across the ...

OESA-2026-3244 sg3_utils security update

The sg3utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI e.g. Fibre Channel FCP, Serial Attached SCSI SAS and the SCSI Parallel InterfaceSPI many other devices use SCSI command sets. ATAPI cd/dvd drives and SAT...

PT-2026-69132

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description The /$result endpoint allows a caller with a valid async export job ID to provide file parameter values containing path traversal sequences. Path traversal is a technique used to access files...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-65552

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684 WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

EUVD-2026-53895

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

The CVE-2026-66684 entry concerns the WordPress plugin Export Import Menus, affected versions ≤ 1.9.2. The vulnerability is an unauthenticated sensitive data exposure in the export/import functionality. No concrete exploit details, affected files, root cause, or remediation are provided in the av...

CVE-2026-65552 WordPress Export User Data plugin <= 2.2.6 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

CVE-2026-65552

CVE-2026-65552 concerns the WordPress Export User Data plugin (versions

EUVD-2026-53980

Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...