Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

CVE-2026-86439

## Overview Verified. Multiple **Unrestricted Path Traversal** vulnerabilities exist in the Knowns MCP `docs` and `memo

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function...

CVE-2026-97365

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file cr

历史摘要 · 未重新核验 · GitHub Advisory

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server...

CVE-2026-82708

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with acce

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts...

CVE-2026-97323

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOrigina

历史摘要 · 未重新核验 · GitHub Advisory

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

CVE-2026-57171

**At a glance** - **Actor:** attacker who controls the -o/--output argument to trestle author {catalog,profile,ssp}-gen

历史摘要 · 未重新核验 · GitHub Advisory

langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs

## Summary `langchain-nvidia-ai-endpoints` versions before 1.4.2 accepted local filesystem paths as image inputs for Vi

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor ...

CVE-2026-96898

ShopXO 是一套基于 PHP/ThinkPHP 开发的开源电商系统，主仓库位于 yhx070424 名下。本次披露的问题影响 2.2.7 及更早版本，缺陷位置在 Ueditor 上传接口的配置代码 config/ueditor.php

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the...

CVE-2026-96884

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the

历史摘要 · 未重新核验 · GitHub Advisory

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The mani...

CVE-2026-96884

CVE-2026-96884 是披露在 MantisZip 0.4.5 及更早版本中的一处路径遍历（Path Traversal）漏洞。根据 NVD 元数据描述，问题出在预览（Preview）组件对应的 MainWindow.UI.cs 文

历史摘要 · 未重新核验 · NVD

A security vulnerability has been detected in weiqingwen spring-boot-forum up to...

CVE-2026-96678

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by man

历史摘要 · 未重新核验 · GitHub Advisory

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main...

CVE-2026-96678

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94

历史摘要 · 未重新核验 · NVD

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/lo...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by man

历史摘要 · 未重新核验 · NVD

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the...

CVE-2026-6925

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could s

历史摘要 · 未重新核验 · GitHub Advisory

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

CVE-2026-6925

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could s

历史摘要 · 未重新核验 · NVD

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDi...

CVE-2026-67224

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace con

历史摘要 · 未重新核验 · NVD

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

CVE-2026-95525

Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

历史摘要 · 未重新核验 · NVD

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A ...

CVE-2026-96651

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, a

历史摘要 · 未重新核验 · NVD

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK,...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak

历史摘要 · 未重新核验 · NVD

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, t...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host f

来源摘录 · NVD