PT-2026-85539

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...

CVE-2026-65688

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

EUVD-2026-48278

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path...

PT-2026-63998

Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation in the font processing feature of the DataHub module allows unauthenticated attackers to read arbitrary files from the server...

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows when using the built-in HTTP form-based file upload mechanism via the mg_handle_form_request API. Web applications that use the file upload form handler and use parts of the user-controlled filename in the output path are susceptible to directory traversal

...

Security update for civetweb (moderate)

openSUSE Security Update: Security update for civetweb Announcement ID: openSUSE-SU-2021:1424-1 Rating: moderate References: 1191938 Cross-References: CVE-2020-27304 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This update for civetwe...

[SECURITY] [DLA 2752-1] squashfs-tools security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2752-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz August 31, 2021 https://wiki.debian.org/LTS -...

Directory Traversal

pimcore is vulnerable to directory traversal attacks. The library does not properly validate the filepath, allowing a malicious user to pass a filepath without the file to the application...