CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe (introduced in version 2.6.0 ) allows an attacker to bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. The root cause is improper handling of quotation marks during path validation, enabling files outsi...

EUVD-2026-76118

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-56718

CVE-2026-56718 Traversal de ruta no autenticado en jdbhttpd/0.1.0 firmware AJCloud AJY IPC que permite la lectura remota de archivos arbitrarios como root, incluidas las credenciales RTSP en texto claro. CWE: CWE-22 Limitación inadecuada de un nombre de ruta a un directorio restringido Severidad:...

CVE-2026-89250

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-89242

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

CVE-2026-89250

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint. The endpoint streams recorded FLV files from a temporary directory without authentication or authorization checks, allowing attackers who kn...

EUVD-2026-76062

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-89250 WWBN AVideo Unauthenticated File Read via getRecordedFile.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFile.php endpoint that streams recorded FLV files from the temporary directory. Attackers can request the endpoint with a known or guessed stream key to downlo...

CVE-2026-89242 WWBN AVideo Unauthenticated SSRF via login.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

EUVD-2026-76054

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php t...

CVE-2026-89242

WWBN AVideo versions through commit c3edcc274c389816d434acadac07ee78eaf330c1 contain a server-side request forgery (SSRF) in the _json_decode function, which fetches remote URLs and local file paths without validation. An unauthenticated attacker can POST file paths or HTTP URLs to login.json.php...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

EUVD-2026-76020

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

CVE-2026-87727

a-blog cms (by appleple inc.) versions 3.2.33 and earlier contain a path traversal vulnerability (CWE-22) that allows a remote unauthenticated attacker to read or delete arbitrary files on the server. The vulnerability is only exploitable when the form setting "Attaching files to emails addressed...

CVE-2026-87727

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...

EUVD-2026-75793

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-77807

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...

EUVD-2025-210892

Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...