GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

GHSA-MRVP-7WMX-5M4H Contao: Path traversal in the images controller

ImagesController joins the user controlled path onto the configured image target directory with Path::join, which canonicalises .. segments, and never calls Path::isBasePath to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore...

Contao: Path traversal in the images controller

ImagesController joins the user controlled path onto the configured image target directory with Path::join, which canonicalises .. segments, and never calls Path::isBasePath to confirm the result stayed inside that directory. An unauthenticated GET with percent encoded dot segments therefore...

RHLW-2026-67AFC831A93FF9CC Lightwell Security Advisory: spring-webmvc 5.3.18.rhlw-00010

Red Hat Lightwell has released org.springframework:spring-webmvc 5.3.18.rhlw-00010 with backported fixes for CVE-2023-20860, CVE-2024-38816, CVE-2024-38819, CVE-2024-38828, CVE-2025-41242, CVE-2026-22735, CVE-2026-22737, CVE-2026-22741, and CVE-2026-22745. CVE-2023-20860: Spring Framework running...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

EUVD-2026-95986

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-107844

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 6.1.2 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Listdom versions = 6.1.2...

CVE-2026-75351

A flaw was found in OpENer. An out-of-bounds read vulnerability in the server-side EtherNet/IP ForwardOpen connection-path parser allows a remote attacker to trigger an application crash. By sending a specially crafted connection request, an attacker can exploit this flaw to cause a Denial of...

CVE-2026-107844

The Contao Open Source CMS (versions 5.0.0 to 5.3.50 and 5.7.12) is vulnerable to a path traversal flaw in the ImagesController . The root cause is the use of Path::join() with a user-controlled {path} parameter without utilizing Path::isBasePath() to validate that the resulting path remains with...

EUVD-2026-95974

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

CVE-2026-107844

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

CVE-2026-107844 Contao: Path traversal in the images controller

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

CVE-2026-107844 Contao: Path traversal in the images controller

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

CVE-2026-107844 Contao: Path traversal in the images controller

Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...

Exploit for CVE-2026-21589

CVE-2026-21589 — Atlassian Arbitrary File Read An unauthentic...

RHLW-2026-A4C4A4BF58E29184 Lightwell Security Advisory: json-path 2.7.0.rhlw-00001

Red Hat Lightwell has released com.jayway.jsonpath:json-path 2.7.0.rhlw-00001 with a backported security fix. CVE-2023-51074: json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse method. This patched artifact is a drop-in replacement for com.jayway.jsonpath:json-path...