Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using ...

CVE-2026-49356

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an a

历史摘要 · 未重新核验 · NVD

motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

CVE-2026-31978

### Summary motionEye v0.43.1 (latest stable) is vulnerable to path traversal in the picture and movie API endpoints, l

历史摘要 · 未重新核验 · GitHub Advisory

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This...

CVE-2026-12479

A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafte...

CVE-2026-56448

A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e4

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an...

CVE-2026-12821

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of th...

CVE-2026-12821

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file

历史摘要 · 未重新核验 · NVD

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets...

CVE-2026-56394

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the ex

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the extension parameter is not validated before file existence ...

CVE-2026-56394

Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon endpoint where the ex

历史摘要 · 未重新核验 · NVD

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to...

CVE-2026-11911

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

历史摘要 · 未重新核验 · GitHub Advisory

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DeleteFile function in all versions up t...

CVE-2026-11911

The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validat

历史摘要 · 未重新核验 · NVD

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to...

CVE-2026-9843

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion

历史摘要 · 未重新核验 · GitHub Advisory

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the view_page...

CVE-2026-9843

CVE-2026-9843 是一个影响 WordPress 插件 'Database for Contact Form 7, WPforms, Elementor forms'（版本 ≤ 1.5.1）的高危漏洞。该漏洞存在于 view_pa

历史摘要 · 未重新核验 · NVD

Anki's local HTTP server does not sufficiently validate requests

## Summary Anki launches a local HTTP server to serve media files and web pages for parts of its interface. The server

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (

历史摘要 · 未重新核验 · GitHub Advisory

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_n

历史摘要 · 未重新核验 · GitHub Advisory

LangSmith SDK TracingMiddleware: Arbitrary server-side file read

# Summary An attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can caus

历史摘要 · 未重新核验 · GitHub Advisory

Anki: User scripts in iframes have access to the internal Anki API

## Summary Anki's webview-based pages communicate with the Rust backend using an internal localhost API. Anki implement

历史摘要 · 未重新核验 · GitHub Advisory

EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id

EverOS versions 1.0.0 and earlier are vulnerable to path traversal in the POST /api/v1/memory/add ingestion endpoint. Th

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles

历史摘要 · 未重新核验 · GitHub Advisory