Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' com...

CVE-2026-54200

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax,

历史摘要 · 未重新核验 · NVD

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENT...

CVE-2026-12070

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email,

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulatio...

CVE-2026-19011

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packa

历史摘要 · 未重新核验 · NVD

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. T...

CVE-2026-19009

A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core

历史摘要 · 未重新核验 · NVD

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control...

CVE-2026-16054

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated us

历史摘要 · 未重新核验 · NVD

External control of file name or path in Microsoft Edge for Android allows an unauthorized...

CVE-2026-65802

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose informat

历史摘要 · 未重新核验 · GitHub Advisory

External control of file name or path in Microsoft Edge for Android allows an unauthorized...

CVE-2026-66310

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose informat

历史摘要 · 未重新核验 · GitHub Advisory

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

CVE-2026-66310

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose informat

历史摘要 · 未重新核验 · NVD

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

CVE-2026-65802

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose informat

历史摘要 · 未重新核验 · NVD

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version

历史摘要 · 未重新核验 · GitHub Advisory

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an out...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_proce

历史摘要 · 未重新核验 · NVD

RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_proce

历史摘要 · 未重新核验 · OSV.dev

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir inste...

CVE-2026-67429

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related fi

历史摘要 · 未重新核验 · NVD

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifyi

历史摘要 · 未重新核验 · NVD

proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local exec...

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An attacker can prepare ar

历史摘要 · 未重新核验 · NVD

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplie

历史摘要 · 未重新核验 · GitHub Advisory

LiteLLM: Local file read via request-supplied OIDC file references

CVE-2026-59819

### Impact LiteLLM's `/health/test_connection` endpoint resolved request-supplied environment and OIDC file references

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

## Impact The n8n Edit Image node passed its output format to the underlying image library without validation, so a cra

历史摘要 · 未重新核验 · GitHub Advisory

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privile...

CVE-2026-14551

The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are v

历史摘要 · 未重新核验 · NVD