Total
748 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-76210 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-09-01 | N/A | 6.5 MEDIUM |
| phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an <img> tag whose src references a local file under the web root's content/ directory (e.g., content/core/config/database.php). When the PDF is generated, phpMyFAQ attempts to read the referenced file; because it is not a valid image the resulting error is converted into an uncaught exception whose stack trace discloses part of the file's contents to any user who triggers the PDF export. By default the disclosed portion is truncated (zend.exception_string_param_max_len), but a larger configured value can result in disclosure of entire files, including database credentials. | |||||
| CVE-2026-0965 | 2 Libssh, Redhat | 2 Libssh, Enterprise Linux | 2026-09-01 | N/A | 3.3 LOW |
| A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations. | |||||
| CVE-2026-79674 | 1 Nltk | 1 Nltk | 2026-08-31 | N/A | 8.2 HIGH |
| NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary. | |||||
| CVE-2026-19084 | 2026-08-28 | N/A | 7.5 HIGH | ||
| The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL. | |||||
| CVE-2026-77016 | 2026-08-28 | N/A | 9.6 CRITICAL | ||
| The Workeera WordPress plugin before 1.0.6 does not restrict which values may be written to a user's own candidate profile, and does not validate or contain the stored file path before deleting it, allowing users with a role as low as subscriber to delete arbitrary files on the server. | |||||
| CVE-2026-12513 | 2026-08-28 | N/A | 6.8 MEDIUM | ||
| The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.68 do not properly sanitize a file path taken from a frontend file submission and their single-pass traversal filter is bypassable, allowing unauthenticated users to store a path that points outside the uploads directory. When the corresponding file entry is later permanently deleted, an arbitrary file on the server (such as wp-config.php) is deleted, leading to denial of service and potential site takeover. | |||||
| CVE-2026-58192 | 1 Appium | 1 Appium\/storage-plugin | 2026-08-26 | N/A | 8.6 HIGH |
| Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6. | |||||
| CVE-2026-16054 | 2026-08-26 | N/A | 9.1 CRITICAL | ||
| The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and irreversibly destroy customers' pending order attachments. | |||||
| CVE-2026-17014 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores. | |||||
| CVE-2026-77693 | 2026-08-26 | N/A | 8.7 HIGH | ||
| The Order Tip for WooCommerce WordPress plugin before 1.6.0 does not check the capability of the user requesting a file deletion, nor does it restrict which path may be deleted, allowing users with the Shop Manager role and above to delete arbitrary files on the server, which could lead to the site being taken over. | |||||
| CVE-2026-18048 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root. | |||||
| CVE-2026-20358 | 2026-08-21 | N/A | 10.0 CRITICAL | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20358 are related to external control of the file system issues that are grouped Common Weakness Enumeration (CWE) CWE-73. | |||||
| CVE-2026-17184 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-21 | N/A | 9.8 CRITICAL |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path. | |||||
| CVE-2023-21800 | 1 Microsoft | 1 Windows Server 2008 | 2026-08-19 | N/A | 7.8 HIGH |
| Windows Installer Elevation of Privilege Vulnerability | |||||
| CVE-2023-21566 | 1 Microsoft | 3 Visual Studio 2017, Visual Studio 2019, Visual Studio 2022 | 2026-08-19 | N/A | 7.8 HIGH |
| Visual Studio Elevation of Privilege Vulnerability | |||||
| CVE-2026-17482 | 1 Ibm | 1 Documentation Offline | 2026-08-17 | N/A | 9.8 CRITICAL |
| IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths. | |||||
| CVE-2026-16898 | 1 Ibm | 1 I | 2026-08-17 | N/A | 7.8 HIGH |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path. | |||||
| CVE-2026-16987 | 1 Ibm | 1 I | 2026-08-17 | N/A | 8.8 HIGH |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable. | |||||
| CVE-2026-19009 | 2026-08-12 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of the file packages/core/src/response.ts of the component Message API Endpoint. This manipulation causes file inclusion. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-19011 | 2026-08-12 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packages/server/src/routes/agents.ts. Performing a manipulation results in file inclusion. The attack may be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||