WordPress StoreEngine plugin <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability

Authenticated Vendor+ Arbitrary File Read via Path Traversal in Downloadable File URL vulnerability discovered by zickzick2 - Sejong University of cyber security student in WordPress Plugin StoreEngine versions = 2.1.1...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability

Unauthenticated Arbitrary ZIP File Deletion via delmyzip Path Traversal vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

GO-2026-6213 Worktree operations may follow symlinks in github.com/go-git/go-git

Worktree operations may follow symlinks in github.com/go-git/go-git...

GO-2026-6214 Path traversal via crafted reference names in github.com/go-git/go-git

Path traversal via crafted reference names in github.com/go-git/go-git...

GO-2026-6189 Path traversal in serve s3 in github.com/rclone/rclone

Path traversal in serve s3 in github.com/rclone/rclone...

Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

GHSA-8RC5-4FR6-64PW Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write

Summary Trivy's plugin manager does not fully validate metadata from a plugin's manifest before using it to construct filesystem paths under the plugin root /.trivy/plugins. A crafted plugin can cause Trivy to write its files the manifest and the downloaded plugin binary outside the plugin root, ...

@rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75859

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-63328

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool. The root cause is a failure to canonicalize symlinks before reading files, allowing an attacker to create workspace symlinks pointing to external files with image extensions. This enables arbitrary ...

CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75914

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

CVE-2026-75914 CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

EUVD-2026-60972

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the imageanalyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without use...

EUVD-2026-60966

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-75859

CodeWhale before 0.8.64 fails to validate file paths in the project config instructions field. A malicious .codewhale/config.toml in a cloned repo can read files outside the workspace and inject their contents into the AI system prompt, enabling exfiltration. CVSS 7.5 HIGH. Patch released; no kno...

CVE-2026-75859 CodeWhale before 0.8.64 Arbitrary File Read via instructions

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...

CVE-2026-75859

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and inject...