ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root use...

CVE-2026-75855

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database an

历史摘要 · 未重新核验 · NVD

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attacker...

CVE-2026-75842

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that

历史摘要 · 未重新核验 · NVD

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation....

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string

历史摘要 · 未重新核验 · NVD

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP...

CVE-2026-15585

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer I

历史摘要 · 未重新核验 · NVD

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when

历史摘要 · 未重新核验 · NVD

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint

CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via

历史摘要 · 未重新核验 · NVD

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

CVE-2026-53766

### Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP

历史摘要 · 未重新核验 · GitHub Advisory

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server...

CVE-2026-75482

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths t

历史摘要 · 未重新核验 · GitHub Advisory

Evidently UI fails to properly validate the filename parameter in the dataset materialization...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthe

历史摘要 · 未重新核验 · GitHub Advisory

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing...

CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitr

历史摘要 · 未重新核验 · GitHub Advisory

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow...

CVE-2026-19589

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system

历史摘要 · 未重新核验 · GitHub Advisory

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler wi...

CVE-2026-75482

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths t

历史摘要 · 未重新核验 · NVD

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supp...

CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitr

历史摘要 · 未重新核验 · NVD

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an auth...

CVE-2026-54336

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.

历史摘要 · 未重新核验 · NVD

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_clea...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GE

历史摘要 · 未重新核验 · NVD

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachmen...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/

来源摘录 · NVD

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containme...

CVE-2026-57233

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted Z

历史摘要 · 未重新核验 · NVD

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts_with against ...

CVE-2026-52886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute

历史摘要 · 未重新核验 · NVD

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code.

CVE-2026-50776

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote attacker to obtain sensi

历史摘要 · 未重新核验 · NVD

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/sessio

历史摘要 · 未重新核验 · GitHub Advisory