97790 matches found
CVE-2026-47429
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...
EUVD-2026-44436
Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to access sensitive files or directories outside the...
GHSA-9HC2-HJX8-Q6PV TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution
Description TidGi Desktop through 0.13.0 contains a critical remote code execution vulnerability exploitable via a single Git repository import. The vulnerability leverages TiddlyWiki's module system, which automatically discovers and executes JavaScript code embedded in .tid files placed in the...
MAL-2026-10611 Malicious code in @web3-helpers/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d5230cf08adcdf1d9108129f5c80e569b74774b7f2cb5e55aeb60be8d737225 At npm install time the preinstall script dist/index.min.js reads installer-owned secrets — /.ssh/idrsa, /.env, /.env.local, /.wallet.json — and...
CVE-2026-13001 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter
The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlovehandlecachefiles' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...
CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...
CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...
CVE-2026-48310
Adobe Experience Manager (AEM) is affected by an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal, CWE-22) vulnerability that could enable arbitrary file system read. The issue arises from an improper pathname restriction, allowing access to sensitive files outside the ...
CVE-2026-48359
Adobe Experience Manager is affected by an XML External Entity (XXE) vulnerability (CVE-2026-48359) due to improper restriction of XML External Entity references. It could allow a low-privileged attacker to read sensitive files and potentially gain elevated access or control, with arbitrary code ...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the ATTACH DATABASE process. An attacker can overwrite arbitrary files on the filesystem by sending crafted SQL commands to the server, potentially leading to execution of malicious code or disruption of...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization through the ATTACH DATABASE process. An attacker can overwrite arbitrary files on the filesystem by sending crafted SQL commands to the server, potentially leading to execution of malicious code or disruption of...
EUVD-2026-44116
Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally...
EUVD-2026-43926
Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...
EUVD-2026-43951
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges with a physical attack...
EUVD-2026-43707
A path traversal security issue exists within Studio 5000 Logix Designer® due to improper limitation of file paths within ACD project files. The software does not sanitize or validate file names embedded in the ACD file structure during the project opening procedure, allowing path traversal...
EUVD-2026-43721
openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging sent-mail attachment download functionality that allows an authenticated attacker to read arbitrary files on the server via crafted path traversal sequences...
EUVD-2026-43704
A path traversal security issue exists within Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this vulnerability to write arbitrary files to restricted system directories outside of the...
CVE-2026-58613
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...