CVE-2026-76217

GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-73719

Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2026-85160

AVideo through c91b5975d CSRF and Path Traversal via stopLive.php

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-73720

Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API

Insecure file operations in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed

Vendors

Arubanetworks Hewlett Packard Enterprise (hpe)

Products

Fabric Composer Fabric Composer

CVE-2026-78675

GitPython before 3.1.59 Local File Content Disclosure via .gitmodules

GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Gitpython Project

Products

Gitpython

CVE-2026-16139

Arbitrary file write via path traversal in Progress ShareFile Storage Zones Controller potentially leading to remote code execution

In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zone administrator can exploit improper validation in the download preparation flow, enabling attacker-controlled files to be written outside the intended preparation directory. This can lead to remote code execution in v5 versions. Remote code execution is not confirmed on v6 versions.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-16137

Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Sharefile Storage Zones Controller

CVE-2026-65939

WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-65940

WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.

In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Progress Progress Software

Products

Whatsup Gold Whatsup Gold

CVE-2026-82637

browser-use web-ui 2.0.0 through 3.0.0 Arbitrary Directory Creation

browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Browser-use

Products

Browser Use Web-ui

CVE-2026-84806

Kimai before 2.63.0 Authorization Bypass via Team Access Endpoints

Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit permissions and read-only access to grant team access to customers, projects, or activities. Attackers can exploit insufficient permission checks by sending POST requests to team access endpoints to modify access control lists for entities they should not be able to modify.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kimai

Products

Kimai

CVE-2026-24049

wheel Allows Arbitrary File Permission Modification via Path Traversal

wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Pypa Wheel Project

Products

Wheel Wheel

CVE-2026-79653

Arbitrary File Path Traversal via Attachment Upload in Eclipse SW360

In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storage with config key enable.attachment.store.to.file.system, the attacker can manipulate the filename upon upload and can essentially cause arbitrary file path traversal. The immediate workaround is to disable enable.attachment.store.to.file.system or update to fixed versions.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Eclipse Sw360

CVE-2026-59292

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Spring Vmware

Products

Spring Integration Spring Integration

CVE-2026-82659

nodemailer before 9.0.1 File Read and SSRF via raw option

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nodemailer

Products

Nodemailer

CVE-2026-82697

sambitraj Student-Management-System session_start cookie httponly flag

A security vulnerability has been detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The impacted element is the function session_start. Such manipulation leads to cookie without 'httponly' flag. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sambitraj

Products

Student-management-system

CVE-2026-78208

exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-16444

Improper Validation of File Paths in TeamViewer Desktop Clients

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Teamviewer

Products

Full Client Full Client, Host, Quicksupport & Portable Full Client, Host, Quicksupport & Portable (for Windows 7 & 8) and 7 more

CVE-2026-59682

Arbitrary file overwrite and deletion local and remote in OpenRGB

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Calcprogrammer1

Products

Openrgb

CVE-2026-59683

OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Calcprogrammer1

Products

Openrgb