CWE-73

A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file d

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and inc

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability. A low p

Versions of the Traccar open-source GPS tracking system up to and including 6.11.1 contain an issue in which authenticat

The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 v

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versi

A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the

phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INST

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local Fil

The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Arbitrary

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's

External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing o

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enfo

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce chec

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_proce

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file an

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker wit

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional refere

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoo

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is an unknown function of the file

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file conten

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifyi

AdminExpress 1.2.5 contains a denial of service vulnerability that allows local attackers to crash the application by su

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote loc

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playgroun

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, the psd print sessions dump CLI co

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, the /forms/chromium/convert/url and /forms/c

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that all

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing

OpenClaw before 2026.4.8 treats shared reply MEDIA paths as trusted, allowing crafted references to trigger cross-channe

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpa

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Sq

Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM conta

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a t

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authe

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in th

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server al

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.32.0, pdfengines/merge, pdfengines/split, libreoff

A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function buildSystemPrompt of the file packa

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its