SUSE CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

PT-2026-86414

WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode...

Fedora 44 : composer (2026-5995821369)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5995821369 advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

EUVD-2026-57459

SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers...

GHSA-F794-5JV7-7672 vulnerabilities

Vulnerabilities for packages: nemo, open-webui...

WordPress WP File Download plugin <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability

Authenticated Subscriber+ Arbitrary File Read via Path Traversal in 'remoteurl' Parameter vulnerability discovered by 0xd4rk5id3 - EnvoraSec in WordPress Plugin WP File Download versions = 6.3.8...

CVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...

EUVD-2026-71681

A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-53757

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

EUVD-2026-60966

CodeWhale: Project config instructions override enables arbitrary file read into AI system prompt via cloned repository...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

CVE-2026-53757

Emlog , an open-source website building system, is affected in versions 2.6.29 and prior by a Zip Slip path traversal in the emUnZip() function. The function extracts all ZIP entries via ZipArchive::extractTo() but validates the ../ traversal sequence only for the first entry's subdirectory , all...

CVE-2026-53757 Emlog: Zip Slip Path Traversal in Plugin/Template ZIP Upload Enables RCE

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

EUVD-2026-60972

CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes...

CVE-2026-50553

Note Mark (open-source Go note-taking app, module github.com/enchant97/note-mark/backend) is vulnerable to a path traversal in its data-export CLI commands (migrate export and migrate export-v1) prior to version 0.19.5 . The root cause is an unanchored regex ([a-z0-9-]+) used to validate book and...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...

CVE-2026-17622

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-14470 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...