Total
10217 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-19880 | 2026-08-26 | N/A | N/A | ||
| Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.2. | |||||
| CVE-2026-66493 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities. | |||||
| CVE-2026-67286 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name. | |||||
| CVE-2026-66492 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability. | |||||
| CVE-2026-66491 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability. | |||||
| CVE-2026-75115 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files. | |||||
| CVE-2026-66914 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot. | |||||
| CVE-2026-67285 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system. | |||||
| CVE-2026-76611 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66. | |||||
| CVE-2026-76606 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |||||
| CVE-2026-76598 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings. | |||||
| CVE-2026-58192 | 1 Appium | 1 Appium\/storage-plugin | 2026-08-26 | N/A | 8.6 HIGH |
| Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6. | |||||
| CVE-2025-15673 | 2026-08-26 | N/A | 4.9 MEDIUM | ||
| The Import and export users and customers WordPress plugin before 2.4.3 does not restrict the path of a file it reads and displays during a CSV import, allowing high-privileged users to read arbitrary files on the server. | |||||
| CVE-2026-15932 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server. | |||||
| CVE-2026-15244 | 2026-08-26 | N/A | 7.2 HIGH | ||
| The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors. | |||||
| CVE-2026-16955 | 2026-08-26 | N/A | 5.0 MEDIUM | ||
| The AI Engine WordPress plugin before 3.6.6 does not confine a caller-supplied file path before reading it and forwarding the contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets. | |||||
| CVE-2026-16263 | 2026-08-26 | N/A | 8.8 HIGH | ||
| The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on the server. | |||||
| CVE-2026-18465 | 2026-08-26 | N/A | 6.5 MEDIUM | ||
| The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server. | |||||
| CVE-2026-16940 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing unauthenticated users to delete arbitrary files on the server (such as wp-config.php), which can lead to a full site takeover. | |||||
| CVE-2026-13170 | 2026-08-26 | N/A | 7.2 HIGH | ||
| The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allowing users with editor-level access and above to include and execute arbitrary local PHP files. | |||||