CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-13716 Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-24330

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

GHSA-FG7F-2386-8897 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-58248

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-58248 XML External Entity Injection in SAP BusinessObjects Business Intelligence

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

EUVD-2026-55877

SAP BusinessObjects Business Intelligence Platform Web Intelligence allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes t...

CVE-2026-13716: Path Traversal: '.../...//'

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution...

CVE-2026-48763: Missing Authorization

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

CVE-2026-73034: Improper Limitation of a Pathname to a Restricted Directory

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the userid HTTP header of the Python file-upload endpoint. Attackers can send a crafted...

PT-2026-70890

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.1 Description An unauthenticated path traversal issue exists in the Python file-upload endpoint. Remote attackers can write arbitrary files to any location on the server by injecting directory traversal sequences into the us...

Blocksy Companion 2.1.46 Shell Upload

Blocksy Companion version 2.1.46 suffers from an unauthenticated arbitrary file upload and double-extension bypass that allows for shell uploads. !/usr/bin/env python3 Exploit Title: Blocksy Companion 2.1.46 - RCE CVE: CVE-2026-58480 Date: 2026-07-13 Exploit Author: Mohammed Idrees Banyamer Autho...

CVE-2026-24330: Unrestricted Upload of File with Dangerous Type

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the...

PT-2026-70903

Name of the Vulnerable Software and Affected Versions Malcolm versions prior to 26.06.1 Description The file-upload component FilePond PHP backend allows the upload of arbitrary files because the default allow-list for file types is empty, rendering the type check ineffective. The filename...

PT-2026-70074

Name of the Vulnerable Software and Affected Versions insights-core affected versions not specified Description A flaw in the password redaction layer fails to recognize credentials that are not keyed under the literal string 'password'. This issue allows SSSD LDAP bind passwords, specifically th...

CVE-2026-72557: Unrestricted Upload of File with Dangerous Type

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The alloweduploads configuration defaults to wildcard and uploaded files are stored in a web-accessible directory. An...

PT-2026-70132

Name of the Vulnerable Software and Affected Versions Cockpit CMS version 2.6.0 Description An unrestricted file upload issue allows authenticated users to upload files with any extension, including PHP scripts, through the asset upload endpoint. This occurs because the allowed uploads...

CVE-2026-55676: Unrestricted Upload of File with Dangerous Type

Malcolm is a network traffic analysis tool suite. The file-upload component FilePond PHP backend accepts uploads at POST /server/php/submit.php and stores them in a directory served by the same nginx and php-fpm instance. The allow-list that should restrict accepted file types is an empty array b...