CVE-2026-85687 surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

EUVD-2026-71136

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw filepath parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument,...

CVE-2026-85668

Xinference (v3.x, affected commit 4a94832, specifically v3.3.0) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path parameter without authentication or path confinement, reads and p...

EUVD-2026-71124

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

CVE-2026-85665 Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-85665

Bruno versions through 3.4.2 are affected by an arbitrary file read vulnerability caused by insufficient validation of file paths in request body declarations. An attacker who can influence a collection's body:file path can embed parent-directory traversal (../) sequences that resolve outside the...

CVE-2026-85665 Bruno 3.4.2 Arbitrary File Read via Unconfined Body File Path

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

EUVD-2026-71121

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

EUVD-2026-71117

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCELFILESPATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass in its SQL validation layer. The root cause is that function-name validation is not applied to RangeFunction nodes in FROM clauses , allowing attackers to invoke file-reading functions such as pg_read_file via FROM-clause syntax and read ar...

CVE-2026-85618

ConvertX 0.17.0 contains an arbitrary file read vulnerability in its xelatex converter . Authenticated attackers can upload .tex files containing \input{path} or \verbatiminput{path} directives, causing the TeX engine to read arbitrary files accessible to the server process and include their cont...

EUVD-2026-71225

ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uploading LaTeX files with input directives. Attackers can upload .tex files containing \inputpath or \verbatiminputpath directives to have the TeX engine read...

CVE-2026-85606

firecrawl-mcp-server version 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool. The root cause is the acceptance of unconstrained filePath arguments without directory containment validation, allowing an attacker to supply absolute paths or directory traversal ...

EUVD-2026-71222

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawlparse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...

CVE-2025-68493

CVE-2025-68493 CVE-2025-68493 7. 参考资料 1 ApacheStrutsXWorkXML漏洞CVE-2025-68493poc及脚本 | ZONE.CI 全球网. https://zone.ci/secarticles/wx/486533.html 8. 漏洞验证与利用 为了验证和利用 CVE-2025-68493 漏洞，可以使用以下提供的 Python PoC 脚本和 Nuclei YAML 模板。 8.1 Python PoC 脚本使用方法 脚本名称 : cve202568493poc.py 功能 :...

CVE-2026-74235

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

CVE-2026-74237

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

WordPress Pods plugin 3.3-3.3.9.1 - Author+ Arbitrary File Read vulnerability

Author+ Arbitrary File Read vulnerability discovered by Erwan LR WPScan in WordPress Plugin Pods versions 3.3-3.3.9.1...

CVE-2026-74237 GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

EUVD-2026-71086

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...