Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

Windows Shell Spoofing Vulnerability

Improper link resolution before file access 'link following' in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

Microsoft SQL Server Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in SQL Server allows an authorized attacker to elevate privileges over a network...

Windows Update Stack Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Update Stack allows an authorized attacker to elevate privileges locally...

Windows NTFS Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows NTFS allows an authorized attacker to elevate privileges locally...

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dodoh4t in WordPress Plugin Youzify versions = 1.3.7...

EUVD-2026-72555

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

PT-2026-87417

🚨 CVE-2026-69379: TOCTOU in ReFsDedupSvc Enables Arbitrary File Overwrite as SYSTEM + Video -Prediction: 📈 3 Positive | 📉 2 Negative https://t.co/rowJAcSEeL Educational Purposes!...

CVE-2026-86439

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439

Knowns versions before 0.30.0 contain a path traversal vulnerability in MCP tool arguments (specifically the doc_store and memory_store components). Filesystem paths supplied by users are not validated, allowing an attacker with low privileges to read, create, overwrite, or delete Markdown files ...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439 knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

PT-2026-86454

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description An issue exists where the SSH server enters the connection protocol following a client-requested rekey without requiring user...

GHSA-F794-5JV7-7672 vulnerabilities

Vulnerabilities for packages: open-webui, nemo...

CVE-2026-85671

QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/localdocqa/getfilebase64 and /api/localdocqa/getdoc endpoints that allows unauthenticated attackers to access any uploaded file or document. Attackers can enumerate file identifiers through unauthenticated endpoints and...

CVE-2026-85661

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85688 TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

CVE-2026-85688

TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...

CVE-2026-85661

excel-mcp-server 0.1.8 (by haris-musa) contains a path confinement bypass in stdio mode : when the EXCEL_FILES_PATH environment variable is unset, unchecked file paths supplied to the read and write tools allow an attacker to read and write arbitrary files accessible to the process. The vulnerabi...