EUVD-2026-96052

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the process function in all versions up to, and including, 4.7.13 This makes it possible for unauthenticated attackers to delete arbitrary safe...

CVE-2026-89301

The rtMedia for WordPress, BuddyPress and bbPress plugin is vulnerable in all versions up to and including 4.7.13 due to insufficient file path validation in the process function. This flaw allows unauthenticated attackers to perform limited file deletion of arbitrary safe files on the server via...

CVE-2026-108156

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

EUVD-2026-95904

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

CVE-2026-26832

CVE-2026-26832: OS command injection in node-tesseract-ocr Summary node-tesseract-ocr through version 2.2.1 allows OS command injection in recognize in src/index.js. The package builds a shell command string and executes it with childprocess.exec. Because the input path is only wrapped in double...

Elastic Agent 8.19.13 < 8.19.22 / 9.2.7 <= 9.2.8 / 9.3.x <= 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-194)

The version of Elastic Agent / Elastic Endpoint installed on the remote Windows host is 8.19.13 through 8.19.21, or 9.2.7 through 9.2.8, or 9.3.x through 9.3.8, or 9.4.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a denial of service vulnerability as referenced in the...

CVE-2025-65321

CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...

CVE-2026-53713

A flaw was found in Envoy Gateway. An authenticated attacker with permissions to submit Lua extension policies can bypass file path restrictions by submitting paths containing redundant slashes. This flaw allows the attacker to read arbitrary files from the gateway controller container, resulting...

CVE-2026-26831

CVE-2026-26831: OS command injection in textract Summary textract through version 2.5.0 allows OS command injection through the file path supplied to multiple extractors. Several code paths pass that file path into childprocess.exec with inadequate sanitization. An attacker who can influence the...

EUVD-2026-43174

PraisonAI: Project custom command templates can read outside-workspace files into model prompts...

CVE-2026-90817

CVE-2026-90817 — REDCap Survey Passthru + Data Import RCE Python 3 checker and configurable exploit hook for CVE-2026-90817 Securifera / Ryan Wincey. | ---|--- Product| REDCap Vanderbilt Affected| ≥ 13.3.0 until branch patch Fixed| 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard+ CVSS 3.1| 9.8 Critical...

CVE-2026-39813

🛡️ CVE-2026-39813 - Fortinet FortiSandbox Path Traversal Vulnerability 📌 Overview CVE-2026-39813 is a critical path traversal vulnerability affecting Fortinet FortiSandbox. The vulnerability arises due to improper validation of user-supplied file paths, allowing attackers to manipulate directory...

-CVE-2022-44268

PNG Image Generator This Python script generates a PNG image filled with a specific color and embeds a file path as metadata using the Pillow library. Running the Script Prerequisites Python install from Python's official website Pillow library pip install pillow Steps 1. Clone the Repository: gi...

CVE-2024-42992

CVE-2024-42992 Python Pip Pandas v2.2.2 has been found to contain an arbitrary file Pip Pandas all versions - =2.2.2 An arbitrary file read vulnerability exists in the "pandas" library, allowing an attacker to read any file in the file system without restrictions. This vulnerability enables...

CVE-2021-43799

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All credits go to j0v and his tweet https://twitter.com/j0v0x0/status/1466845212626542607 Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. In good faith, I've held back releasing...

CVE-2022-39802

3242933 – CVE-2022-39802 File path traversal vulnerability in SAP Manufacturing Execution General information Risk: CRITICAL Versions Affected: SAP MFG EXECUTION CORE 15.1 SAP MFG EXECUTION CORE 15.2 SAP MFG EXECUTION CORE 15.3 Vendor URL: https://sap.com Bug: File path traversal vulnerability...

CVE-2024-23897

CVE-2024-23897 Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controll...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...