Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2,839

CVE-2026-87815

SiYuan before v3.8.2 Path Traversal via removeRiffDeck

SiYuan versions before v3.8.2 contain a path traversal vulnerability in the /api/riff/removeRiffDeck endpoint that fails to validate the deckID parameter. An authenticated administrator can supply path traversal sequences to delete arbitrary .deck and .cards files outside the workspace directory.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-87988

Unrestricted File Access via Unvalidated Commands in Mistral Vibe

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mistral
Products
Mistral-vibe
CVE-2026-77005

Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal

The CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 does not validate a user-supplied file path before deleting a file, and does not check the capability of the user making the request, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-88899

knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Knowns-dev
Products
Knowns
CVE-2026-66324

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge Edge Chromium
CVE-2026-24708

openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Openstack
Products
Compute Nova
CVE-2026-53581

ntp: write path traversal

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Opnsense
Products
Core
CVE-2026-86995

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-79617

Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter

Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus LightDM Greeter: before 0.4.15.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tubitak Bilgem Software Technologies Research Institute
Products
Pardus Lightdm Greeter
CVE-2026-53956

Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the `ratter_cache` code used the package record `build` string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that field, causing package contents to be written outside the configured package cache directory. The issue requires use of a malicious or otherwise untrusted conda channel. Curated channels that validate package metadata are not expected to allow malformed build strings of this form. Users should upgrade to `rattler_cache` version 0.9.0 or `py-rattler` version 0.24.0 and avoid untrusted conda channels.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Conda
Products
Py-rattler Rattler
CVE-2026-86741

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed library resolves server-side and returns as email attachments, exfiltrating sensitive files like .env credentials and enabling SSRF attacks.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Grokability Snipeitapp
Products
Snipe-it Snipe-it
CVE-2026-19583

Velociraptor Required Permissions bypass by using client monitoring queries

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS type. This allows any user who can schedule client monitoring artifacts to also schedule otherwise restricted artifacts (such as Linux.Sys.BashShell).

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Rapid7
Products
Velociraptor
CVE-2026-79426

Arbitrary File Deletion via Authenticated POST in CRMEB 6.0.0

An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Crmeb
Products
Crmeb
CVE-2026-53508

oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there. This issue has been patched in version 1.18.1.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Oasdiff
Products
Oasdiff
CVE-2026-79692

External Control of File Name or Path Enables Remote Filesystem Access in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Secure Connect Gateway
CVE-2026-86751

Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrating sensitive files like .env containing APP_KEY.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Snipeitapp
Products
Snipe-it
CVE-2026-85684

marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existing files on the system.

CVSS 4.0 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Datalab-to
Products
Marker
CVE-2026-82312

openvpn: OpenVPN: Denial of service via NULL DACL on named IPC objects

OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-81830

OpenVPN: OpenVPN: Security Bypass via incorrect file path validation

The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Openvpn
Products
Openvpn
CVE-2026-54200

TeamDavid: Local File Inclusion via the form field 'scjob'

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user. A filter is in place that restricts access to the David con-fig folder and the user folder. However, this filter can be bypassed by specifying an alternate data stream, allowing the download of sensitive files such as other users' access files containing their passwords or the server's private key. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Tobit Laboratories Ag
Products
Teamdavid