OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST

历史摘要 · 未重新核验 · OSV.dev

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can ...

CVE-2026-85176

DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbi

历史摘要 · 未重新核验 · NVD

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting ...

CVE-2026-85160

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php t

历史摘要 · 未重新核验 · NVD

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that...

CVE-2026-84478

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated a

历史摘要 · 未重新核验 · GitHub Advisory

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying dire...

CVE-2026-84478

WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated a

历史摘要 · 未重新核验 · NVD

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php

历史摘要 · 未重新核验 · NVD

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticated malicious actor, under specific conditions outside the...

CVE-2026-73770

An authenticated arbitrary file write vulnerability exists in AOS-CX. Successful exploitation could allow an authenticat

历史摘要 · 未重新核验 · NVD

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation coul...

CVE-2026-73720

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to ac

历史摘要 · 未重新核验 · NVD

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful...

CVE-2026-73719

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticat

历史摘要 · 未重新核验 · NVD

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a fro

历史摘要 · 未重新核验 · GitHub Advisory

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-r...

CVE-2026-82393

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's

历史摘要 · 未重新核验 · NVD

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.

历史摘要 · 未重新核验 · NVD

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.

历史摘要 · 未重新核验 · OSV.dev

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perf...

CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowin

历史摘要 · 未重新核验 · NVD

nodemailer before 9.0.1 File Read and SSRF via raw option

CVE-2026-82659

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowin

历史摘要 · 未重新核验 · OSV.dev

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing atta

历史摘要 · 未重新核验 · GitHub Advisory

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by sup...

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing atta

历史摘要 · 未重新核验 · NVD

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

CVE-2026-82637

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing atta

历史摘要 · 未重新核验 · OSV.dev

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-66324

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoo

来源摘录 · NVD

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary...

CVE-2026-19084

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured im

历史摘要 · 未重新核验 · NVD