Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operat...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wa

历史摘要 · 未重新核验 · NVD

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

CVE-2026-54629

## Summary Anyquery's `server` mode lacks input sanitization and access control over its built-in SQLite virtual table m

历史摘要 · 未重新核验 · GitHub Advisory

yutu: Arbitrary File Write via MCP `caption-download` Tool

CVE-2026-50158

## Arbitrary File Write via MCP `caption-download` Tool ### Summary The `caption-download` MCP tool in yutu passes the

历史摘要 · 未重新核验 · GitHub Advisory

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

CVE-2026-50006

## Summary Anyquery's `server` mode does not disable or restrict native SQLite disk manipulation commands. Unauthenticat

历史摘要 · 未重新核验 · GitHub Advisory

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-50462

External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to

历史摘要 · 未重新核验 · NVD

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally.

CVE-2026-55002

External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally.

历史摘要 · 未重新核验 · NVD

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVE-2026-54108

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing o

历史摘要 · 未重新核验 · NVD

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attack...

CVE-2026-61462

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to re

历史摘要 · 未重新核验 · NVD

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable applic...

CVE-2026-13014

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administra...

CVE-2026-15540

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function

历史摘要 · 未重新核验 · NVD

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload wor

历史摘要 · 未重新核验 · GitHub Advisory

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filen...

CVE-2026-14480

OpenPLC Runtime v3 的遗留 Web UI 程序上传功能中存在一个经过身份验证的任意文件写入漏洞。应用程序将攻击者提供的文件名 (prog_file) 直接存入 Programs.File 数据库字段，后续在保存上传文件时未

历史摘要 · 未重新核验 · NVD

mcp-atlassian: Arbitrary server-side file read via attachment upload

### Summary A client that can invoke MCP tools can read **arbitrary files from the server host** and exfiltrate them as

历史摘要 · 未重新核验 · GitHub Advisory

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI command in coturn takes a filename argument and directly pa...

CVE-2026-53449

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI co

历史摘要 · 未重新核验 · NVD

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

CVE-2026-59793

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

历史摘要 · 未重新核验 · NVD

psd-tools vulnerable to arbitrary file write via smart-object filename

CVE-2026-49836

# psd-tools: arbitrary file write/read via smart-object path traversal ## Summary In `psd-tools` (all releases exposin

历史摘要 · 未重新核验 · GitHub Advisory

Rattler vulnerable to package cache path traversal via conda package build string

CVE-2026-53956

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from con

历史摘要 · 未重新核验 · GitHub Advisory

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows...

CVE-2026-59807

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and ex

历史摘要 · 未重新核验 · GitHub Advisory

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storag...

CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior

历史摘要 · 未重新核验 · NVD

Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior

历史摘要 · 未重新核验 · OSV.dev