EUVD-2026-68920

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

PT-2026-84108

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

ROS-20260901-73-0018

The vulnerability of the smname function in the src/GitPython/git/objects/submodule/util.py file of the Python library for interacting with Git repositories in GitPython is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious...

SUSE CVE-2026-70626

NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not account for symlink resolution, enabling attackers to place...

CVE-2026-70626

A flaw was found in NLTK. This vulnerability allows a local attacker to read arbitrary files outside of the intended directory. By placing symbolic links symlinks within the corpus root, an attacker can bypass path validation in the CorpusReader.open function, which does not properly account for...

Important: samba

Issue Overview: A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for syst...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 contain an arbitrary directory creation vulnerability in the run_agent_task function. The affected parameters (save_recording_path , save_trace_path , save_agent_history_path , save_download_path ) accept unvalidated absolute paths, and the attack i...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

EUVD-2026-68213

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

CVE-2026-82637 browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in runagenttask, allowing attackers to create directories at arbitrary locations by supplying absolute paths to saverecordingpath, savetracepath, saveagenthistorypath, or savedownloadpath parameters. Attackers...

VulnCheck KEV: CVE-2026-2614

A vulnerability in the createmodelversion handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied paths in the HttpRequestHandler.java and StaticFileHandler.java components. An attacker can access arbitrary files on the underlying operating system by sending specially...

CVE-2026-19084

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

CVE-2026-19084 Shared Files < 1.7.70 - Unauthenticated Arbitrary File Read

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

CVE-2026-19084

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

PT-2026-82875

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL...

CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...