CVE-2026-75855 ArcadeDB before 26.8.1 Path Traversal via create/drop database

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

CVE-2026-75855

ArcadeDB versions before 26.8.1 do not sanitize database names in the POST /api/v1/server endpoint, allowing authenticated root users to supply ../ sequences for arbitrary file creation or recursive directory deletion. CVSS 8.7 HIGH; exploitation details not provided. Remediation is to upgrade to...

EUVD-2026-60594

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75830

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-75830 grav-plugin-api before 1.0.15 Path Traversal via batchCopy

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907

Grav before 2.0.15 uses string prefix matching instead of directory-boundary validation in the static asset server (index.php), allowing unauthenticated attackers to access sibling-directory files by requesting paths like assets-secret when assets is the base. Upgrade to Grav 2.0.15 or later to r...

EUVD-2026-60588

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-75627

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

EUVD-2026-60578

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...

CVE-2026-75627

Bastillion's controller dispatcher (BaseKontroller.java) fails to validate request URI paths, allowing unauthenticated attackers to bypass authentication filters by prefixing arbitrary path segments. This grants access to administrative controllers to read user listings, create manager accounts, ...

CVE-2026-74796

A flaw was found in OpenTofu. This vulnerability allows attackers to exploit a symlink following path traversal during the initialization process. By placing a malicious symbolic link in a trusted working directory, an attacker can cause the 'tofu init' command to write provider package contents ...

SUSE-SU-2026:3635-1 Security update for python

This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

VulnCheck KEV: CVE-2026-25895

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched ...

PT-2026-77160

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

Broadcom VMware vCenter Path Traversal Vulnerability

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code...

PT-2026-78229

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

PT-2026-78233

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.8 Description An authenticated project manager can use traversal sequences in the filename parameter of the 'GET /exports/:id/:filename' endpoint. In the server/api/controllers/boards/download.js file, the...