EUVD-2026-87542

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-100533

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...

CVE-2026-100533 OpenClaw before 2026.8.1 Path Traversal via Unicode Fallback

OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the...

EUVD-2026-87520

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materiall...

CVE-2026-100530

Versions of OpenClaw before 2026.8.1 are vulnerable to an issue where the software fails to bind the working directory context to reusable exec approvals . This oversight allows approved commands to execute in different directories than originally intended. An attacker possessing an allow-always ...

Buffalo WSR-2533DHPL2 - Path Traversal

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. id: CVE-2021-20090 info: name: Buffalo WSR-2533DHPL2 - Path...

CVE-2026-100520 Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint

Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticated users to write arbitrary files outside their home directory. Attackers can supply directory traversal sequences in the path parameter to write PHP files in...

CVE-2026-100638: External Control of File Name or Path

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...

CVE-2026-100637: External Control of File Name or Path

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

PT-2026-99308

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description A path traversal issue exists in the 'checkoutRepo' endpoint. Authenticated administrators can overwrite arbitrary JSON files in pre-existing kernel-writable directories outside the workspace boundari...

CVE-2026-18143: Unrestricted Upload of File with Dangerous Type

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

PT-2026-99254

Name of the Vulnerable Software and Affected Versions Request a Quote for WooCommerce versions prior to 2.9.3 Description An arbitrary file upload issue exists in the afrfq submit quote via popup function. The popup upload handler fails to validate file extensions and MIME types, using the raw...

PT-2026-99235

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.5.1 through 2026.7.0 Description The software fails to apply the configured execution approval path to Google Meet node commands. Specifically, the googlemeet.chrome command accepts caller-supplied audio command arrays a...

CVE-2026-100694: Improper Neutralization of Input During Web Page Generation

Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw HTML: Org export blocks and @@html:...@@ snippets pass HTML through unescaped, resulting in cross-site scripting XSS in the generated site...

CVE-2026-100680: Exposure of Sensitive Information to an Unauthorized Actor

Budibase versions before 3.45.0 fail to disable external JSON reference resolution in the OpenAPI/Swagger import validator, allowing authenticated builders to read arbitrary local files. Attackers with builder access can embed file:// references in OpenAPI specifications submitted to the import...

CVE-2026-100599: Improper Neutralization of Special Elements used in an OS Command

OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chrome command accepts caller-supplied audio command arrays and executes them on a paired node without going through the normal system.run approval flow. In...

SUSE CVE-2026-88372

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4readheader when parsing crafted MAT4 MATLAB v4 files...

CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...

CVE-2026-84882

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system...