CVE-2026-15724

Progress ShareFile Storage Zones Controller (SZC) vulnerable to path traversal in versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can read arbitrary files, write to arbitrary directories, or check file existence on the server filesystem. Affected component: SZC; root caus...

CVE-2026-13693 Bit Form < 3.1.0 - Unauthenticated Arbitrary File Read via Path Traversal

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

EUVD-2026-46063

The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element...

CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint GET /api/media/subtitles accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two...

RHEL 9 : httpd (RHSA-2026:41906)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41906 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix...

EUVD-2026-44716

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the...

CVE-2026-20146 Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system to either read or delete arbitrary files. To exploit this vulnerability, the...

DEBIAN-CVE-2026-61859

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy...

PT-2026-60218

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine versions prior to 3.3 Cisco Identity Services Engine versions 3.3 through 3.3 before Patch 12 Cisco Identity Services Engine versions 3.4 through 3.4 before Patch 7 Cisco Identity Services Engine versions 3.5...

PT-2026-60150

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-26 ImageMagick versions 6.9.13-x prior to 6.9.13-51 Description A policy bypass exists in the -script operation due to missing security policy checks. This flaw allows the reading of files from paths that ar...

CVE-2026-47429

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-14903

Ivanti Xtraction vulnerable to path traversal prior to version 2026.2.1. A remote authenticated attacker can read arbitrary files outside the web root due to the underlying flaw. Affected component is the Ivanti Xtraction web interface; exploits or impact details are described as path traversal i...

PT-2026-58009

Name of the Vulnerable Software and Affected Versions 1715-AENTR EtherNet/IP Adapter versions prior to 3.011 Description The 1715-AENTR EtherNet/IP Adapter exposes a network-accessible debug port that lacks proper privilege controls. This allows unauthenticated remote access to intrusive...

CVE-2026-55474

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary...

CVE-2026-54468

Dell Unisphere for PowerMax, versions 10.3.0.5 and prior, contains a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files...

CVE-2026-54468

CVE-2026-54468 affects Dell Unisphere for PowerMax, versions up to 10.3.0.5. It describes a path traversal vulnerability that could allow a low-privileged, remotely authenticated attacker to read arbitrary files. The connected documents confirm the affected product and vulnerability class but do ...

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a...

PYSEC-2026-1137 apache-airflow-providers-apache-drill Improper Input Validation vulnerability

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read fil...

CVE-2026-55111

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight...