CVE-2026-3141

FormGent WordPress plugin (

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...

CVE-2025-10937 Oxford Nanopore Technologies MinKNOW Improper Check for Unusual or Exceptional Conditions

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorize...