A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute ...

CVE-2026-13103

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market

历史摘要 · 未重新核验 · NVD

Manyfold: Authenticated Path Traversal via File Rename

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

历史摘要 · 未重新核验 · OSV.dev

zrok copy writes attacker-controlled WebDAV paths outside the destination root

CVE-2026-45576

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores at

历史摘要 · 未重新核验 · OSV.dev

zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths

CVE-2026-45568

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Fl

历史摘要 · 未重新核验 · OSV.dev

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tr...

CVE-2026-59867

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching re

历史摘要 · 未重新核验 · NVD

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sa...

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and

历史摘要 · 未重新核验 · NVD

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_te...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

历史摘要 · 未重新核验 · NVD

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing th...

CVE-2026-53598

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...

历史摘要 · 未重新核验 · NVD

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validating per-client or pe...

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json wo

历史摘要 · 未重新核验 · NVD

Prompty: Arbitrary File Read via ${file:path} Reference Expansion

CVE-2026-53598

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...

历史摘要 · 未重新核验 · OSV.dev

Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

CVE-2026-59867

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching re

历史摘要 · 未重新核验 · OSV.dev

Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and

历史摘要 · 未重新核验 · OSV.dev

Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (w

历史摘要 · 未重新核验 · OSV.dev

Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF

CVE-2026-59863

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json wo

历史摘要 · 未重新核验 · OSV.dev

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/insert DDP method w...

CVE-2026-52890

Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachm

历史摘要 · 未重新核验 · NVD

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other commands tha...

CVE-2026-15921

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

历史摘要 · 未重新核验 · NVD

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

### Summary The Local REST API's `/vault/{path}` endpoints (GET/PUT/PATCH/POST/DELETE) percent-decode the request path *

历史摘要 · 未重新核验 · GitHub Advisory

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to...

CVE-2026-12997

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.10.4

历史摘要 · 未重新核验 · GitHub Advisory

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them...

CVE-2026-26032

The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a

历史摘要 · 未重新核验 · GitHub Advisory

nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory

CVE-2026-15921

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

历史摘要 · 未重新核验 · OSV.dev