CVE-2026-71453

External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...

GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...

GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

GO-2026-6577 Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via MySQL Client Sandbox Bypass in github.com/projectdiscovery/nuclei...

GO-2026-6591 ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel

ZITADEL: Actions V1 sandbox escape: host file read via require in github.com/zitadel/zitadel...

GO-2026-6574 Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei

Nuclei: Local File Read via Workflow File-Protocol Gate Bypass in github.com/projectdiscovery/nuclei...

CVE-2026-71426

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CVE-2026-102667

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-71426

GetSimple CMS CE versions 3.3.22 and prior are vulnerable to a directory-traversal Local File Inclusion (LFI) . An authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute . When a visitor requests the affected page, this value is passed un...

CVE-2026-71426 GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

EUVD-2026-91020

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

EUVD-2026-91042

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...

CVE-2026-104286

Fortinet FortiMail is vulnerable to a critical path traversal vulnerability (CVE-2026-104286 ) affecting versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9 when the IBE function is enabled. The root cause involves a combination of Path Traversal (CWE-22) and insufficient neutralizati...

CVE-2026-55231

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

EUVD-2026-91037

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-55231 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-55231

The Vvveb CMS is vulnerable to a path traversal flaw in its central path sanitizer, specifically affecting versions prior to 1.0.8.6 . An authenticated user with backup access (e.g., site_admin role or higher) can exploit this to read and delete arbitrary files on the server. Impacted actions inc...

CVE-2026-55231 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-55231 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...

CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...