Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update permissions can place a path traversal string in an asset ...

CVE-2026-55469

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated user with import and assets.update p

历史摘要 · 未重新核验 · NVD

mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

### Summary `confluence_upload_attachment` passes `file_path` directly to `open(file_path, "rb")` with no path validatio

历史摘要 · 未重新核验 · GitHub Advisory

mcp-atlassian: Arbitrary server-side file read via attachment upload

### Summary A client that can invoke MCP tools can read **arbitrary files from the server host** and exfiltrate them as

历史摘要 · 未重新核验 · GitHub Advisory

NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file)

#### Summary An authenticated user with the HR "Manage Employees" permission (`SA_EMPLOYEE`) can upload a file with an a

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

CVE-2026-54066

## Summary The patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the `/export/` route but

历史摘要 · 未重新核验 · GitHub Advisory

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated...

CVE-2025-70796

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.

历史摘要 · 未重新核验 · NVD

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute_tool() prep...

CVE-2026-61432

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaia

历史摘要 · 未重新核验 · NVD

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers c...

CVE-2026-61431

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths

历史摘要 · 未重新核验 · NVD

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml when constructing an Agent, and does not validate ...

CVE-2026-60089

PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-local .praisonai/confi

历史摘要 · 未重新核验 · NVD

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function within src/phpMyFAQ/Export/Pdf/Wrapper.php. A user with ...

CVE-2026-57961

phpMyFAQ before 4.1.5 contains a potential authenticated path traversal vulnerability in the concatenatePaths() function

历史摘要 · 未重新核验 · NVD

Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit thi...

CVE-2026-54468

Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged

历史摘要 · 未重新核验 · NVD

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process ha...

CVE-2026-40005

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacke

历史摘要 · 未重新核验 · NVD

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and he_wrapper_css query parameters proce...

CVE-2026-13347

The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via th

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_package of the file agent/skills/service.py of the component ...

CVE-2026-15331

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function _add_url/_add_pack

历史摘要 · 未重新核验 · NVD

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the file ThemeUtils.java of the component Theme Installation. ...

CVE-2026-15326

A vulnerability was identified in halo-dev halo up to 2.24.2. This affects the function ThemeUtils.unzipThemeTo of the f

历史摘要 · 未重新核验 · NVD

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with default `allow_dangero...

CVE-2026-54760

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAge

历史摘要 · 未重新核验 · NVD

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir`...

CVE-2026-50181

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `Rea

历史摘要 · 未重新核验 · NVD

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query` defense-in-depth ...

CVE-2026-50180

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent`

历史摘要 · 未重新核验 · NVD

psd-tools vulnerable to arbitrary file write via smart-object filename

CVE-2026-49836

# psd-tools: arbitrary file write/read via smart-object path traversal ## Summary In `psd-tools` (all releases exposin

历史摘要 · 未重新核验 · GitHub Advisory

Rattler vulnerable to package cache path traversal via conda package build string

CVE-2026-53956

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from con

历史摘要 · 未重新核验 · GitHub Advisory