CVE-2026-109593

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information...

CVE-2026-109593

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information...

CVE-2026-109593

An unauthenticated attacker with network access to SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files. This vulnerability, identified as CVE-2026-109593 , is caused by CWE-636: Not Failing Securely ('Failing Open') and could potentially expose sensitive information. T...

PT-2026-136271

Name of the Vulnerable Software and Affected Versions SonicWall GMS versions prior to 9.5.3 Description An unauthenticated attacker with network access can read internal files, which may expose sensitive information. This issue can be chained with a SQL injection to escalate from harvesting...

CVE-2026-120501

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501

An Otter Wiki version 2.20.1 before 2.26.2 is vulnerable to a file disclosure vulnerability within the DataTable embedding. This flaw allows attackers who possess page editing permissions—which may include anonymous users under default configurations—to read internal repository files. By providin...

EUVD-2026-115253

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501 An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501 An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-120501: redimp otterwiki: An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows…

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in the DataTable embedding that allows attackers who can edit pages, including anonymous users under the default configuration, to read repository-internal files. Attackers can set an absolute src such as /.git/config to...

CVE-2026-59765

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59765

The Git repository management system Gitea (prior to version 1.27.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) . The root cause involves the use of Go's default http.Get without a custom DialContext in HTTP fetch operations, specifically within migration and OAuth avatar code paths. ...

CVE-2026-59765: Server-Side Request Forgery (SSRF)

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-18597

The PDF creation feature of Foxit PDF Services API supports referencing external files. Although local file access is restricted, an attacker could trigger an SSRF vulnerability by using URL redirection to bypass validation, leading to information disclosure...

PT-2026-66764

Name of the Vulnerable Software and Affected Versions HCL iControl version 4.3.0 Description Security misconfiguration resulting from improper web server or application hardening leads to the public exposure of internal configuration files. Recommendations Update HCL iControl version 4.3.0 to a...

CVE-2026-66415

Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to filegetcontents in the Blueprints::import method without path validation. Attackers can...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion Detection

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 is susceptible to local file inclusion because of insecure handling of a download function that leads to disclosure of internal files due to path traversal with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Franklin...

GHSA-2WM4-VWP6-V7XC Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

Summary Gitea has robust SSRF protection via hostmatcher.NewDialContext for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw http.Get Go's DefaultClient which completely bypasses this protection, enabling SSRF to internal...

CVE-2026-57848 Stoat for Android Internal File Disclosure via Exported ShareTargetActivity URI Validation

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component reachable to any process on the device via the android.intent.action.SEND intent and accepts the file to share as a URI supplied through the android.intent.extra.STREAM extra. The activity does not validate or filte...