A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Execu...

CVE-2026-12198

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nos

历史摘要 · 未重新核验 · NVD

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to...

CVE-2026-12089

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in v

历史摘要 · 未重新核验 · GitHub Advisory

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the ...

CVE-2026-12089

该漏洞影响 WordPress 插件 LWS Optimize – All-in-One Speed Booster & Cache Tools 至 3.3.19 版本。由于函数 combine_current_css() 在组合 CSS

历史摘要 · 未重新核验 · NVD

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability...

CVE-2026-11442

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attacker

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest...

CVE-2026-53825

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

历史摘要 · 未重新核验 · GitHub Advisory

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installat...

CVE-2026-11442

CVE-2026-11442 是 Allegra 软件中 exportReport 方法存在的目录遍历信息泄露漏洞。该漏洞允许经过身份验证的远程攻击者利用对用户提供的路径缺乏充分验证的问题，在文件操作中遍历目录，从而泄露服务账户上下文中的敏

历史摘要 · 未重新核验 · NVD

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows authenticated Gateway operators with operator.write scope to...

CVE-2026-53825

OpenClaw before 2026.4.7 contains an arbitrary file read vulnerability in the memory-wiki ingest feature that allows aut

历史摘要 · 未重新核验 · NVD

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler tr...

CVE-2026-53519

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13,

历史摘要 · 未重新核验 · NVD

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

CVE-2026-54093

### Summary filebrowser builds the download-as-zip / download-as-tar archive entry names with `filepath.ToSlash`, which

历史摘要 · 未重新核验 · GitHub Advisory

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

CVE-2026-54094

## Summary File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/us

历史摘要 · 未重新核验 · GitHub Advisory

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The...

CVE-2026-54394

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisa

历史摘要 · 未重新核验 · GitHub Advisory

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields...

CVE-2026-54394

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisa

历史摘要 · 未重新核验 · NVD

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a ...

CVE-2026-45775

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

历史摘要 · 未重新核验 · NVD

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path traversal vulnerability. Version 26.5.0 fixes the issue.

CVE-2026-43872

Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints are affected by a path

历史摘要 · 未重新核验 · NVD

esbuild allows arbitrary file read when running the development server on Windows

### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in its Media Module

CVE-2026-49742

### Problem Backend users with file download permissions were able to download files from the fallback storage of the fi

历史摘要 · 未重新核验 · GitHub Advisory

TYPO3 CMS has Broken Access Control in its File Abstraction Layer

CVE-2026-49738

### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed a plain string prefix comparison

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8...

CVE-2026-44171

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

历史摘要 · 未重新核验 · NVD

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during ...

CVE-2026-6961

Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mattermost fails to san

历史摘要 · 未重新核验 · NVD

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.p...

CVE-2026-3840

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version strin

历史摘要 · 未重新核验 · NVD