The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable...
CVE-2026-107745
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file d
#cwe-22
共收录 2611 条相关情报。
← 返回所有主题The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the u...
CVE-2026-107745
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to limited media file d
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file ...
CVE-2026-58257
GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the databa
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
CVE-2026-116690
### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated...
CVE-2026-57200
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
CVE-2026-116682
## Summary File read paths resolve symbolic links with `filepath.EvalSymlinks` and then operate on the resolved target
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_ver...
CVE-2026-116690
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with...
CVE-2026-112350
Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unau
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves sy...
CVE-2026-116682
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand
FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
CVE-2026-116682
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read hand
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in ...
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) im
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an ...
CVE-2026-108141
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backe
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an ...
CVE-2026-108140
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backe
systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
CVE-2026-116673
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) im
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary ...
CVE-2026-93864
A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution a
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch....
CVE-2026-117510
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr0
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persi...
CVE-2026-117509
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of th
Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal
CVE-2026-117510
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr0
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload...
CVE-2026-117566
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows...
CVE-2026-116800
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include