3954 matches found
Exploit for CVE-2026-90817
CVE-2026-90817 — REDCap Unauthenticated RCE PoC Authorized Us...
CVE-2026-54584: External Control of File Name or Path
mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...
CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an unintended controller route from a public survey context and by...
PT-2026-96008
Name of the Vulnerable Software and Affected Versions 0717376 cowork bench versions up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d Description In the pdf-tools-mcp component, the ControlFlowNode function within the file local servers/pdf-tools-mcp/pdf tools mcp/server.py is susceptible to...
CVE-2026-84904: Missing Authorization
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
PT-2026-95236
Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...
PT-2026-94375
Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.27.3 Description Authenticated attackers can read arbitrary files by exploiting missing path validation. By providing absolute file paths in the file path parameter, users with valid access tokens can access any fil...
PT-2026-93271
The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Overwrite in all versions up to, and including, 32.0.1 due to insufficient file path validation in the 'baseUrlForFacebook' parameter. This makes it...
CVE-2026-76796
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...
Tencent MSEC Path Traversal
RISK EVALUATION The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. 2. RECOMMENDED...
CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-25827
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...
CVE-2026-15955
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...
CVE-2026-15955 IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...
EUVD-2026-77795
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluenceuploadattachment and confluenceuploadattachments tools pass a client-controlled filepath through src/mcpatlassian/confluence/attachments.py uploadattachment, and the...
Security Bulletin: IBM® Data Server driver for JDBC and SQLJ could allow an evil server to perform an arbitrary file write on the connected client due to improper validation of file paths (CVE-2026-15955)
Summary IBM® Data Server driver for JDBC and SQLJ could allow an evil Db2 server to perform an arbitrary file write on the connected client due to improper validation of file paths. This vulnerability also applies to Db2 due to bundled JDBC and SQLJ components. Vulnerability Details...
CVE-2026-90788
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results i...
CVE-2026-90788
A remote OS command injection vulnerability affects the Template Handler component of magicblack MacCMS10 (version 2026.1000.4055), specifically via manipulation of the file admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html. The attack requires high privileges (authe...
EUVD-2023-60649
An issue was discovered in Softing OPC UA C++ SDK through 6.20 and Softing Secure Integration Server through 1.22. By using FileType renames, it is possible to bypass limitations on assignment of a directory path to FileDirectory OPC UA objects and a file path to File OPC UA objects...