CVE-2026-58415 is a vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68 where internal state files related to WebDAV dead properties are accessible to remote clients. This occurs due to mod_dav_fs allowing GET requests to the .DAV state directory, exposing information about resources the client cannot author. The vulnerability has a medium severity with a CVSS score of 5.3.
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of build context directories into container images.
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files, credentials, or other readable host data to a Confluence page and retrieve it through Atlassian. The advisory traces the vulnerable input and processing flow through confluence_upload_attachment, file_path, and open(file_path, "rb"), which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0.
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashicorp/go-getter under the Anyquery server process and return the selected file contents as queryable table rows. The disclosure is limited only by the filesystem permissions of the server process and can expose system configuration, credentials, and private keys. This issue is fixed in version 0.4.5.
Gallery - Private Photo Vault version 1.0.41 runs an unauthenticated HTTP server accessible on the local network via TCP port 8080. This server exposes files and directory listings from the Android external storage, potentially allowing unauthorized local network users to access private files.
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path before passing it to a file-read function on a public endpoint that lacks any authorization check, allowing unauthenticated attackers to download arbitrary files from the server, including files containing sensitive credentials.
CVE-2026-68831 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where files or directories are accessible to external parties via the Windows Defender Firewall Service. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in multiple Windows 10 builds.
The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Trilium versions prior to 0.104.0 have a vulnerability in the automatic image-download feature that allows authenticated users to read arbitrary local files via file:// URLs in note img tags. This occurs because the feature accepts file URLs without path validation, enabling disclosure of files readable by the Trilium process. Additionally, referencing unbounded sources like /dev/zero can cause memory exhaustion and crash the server. The issue affects the web UI, ETAPI, web clipper, and note imports and requires only an authenticated session or ETAPI token. The vulnerability is fixed in version 0.104.0.
CVE-2026-19093 is a vulnerability in the Tutor LMS WordPress plugin versions before 4.0.6. It allows users with the instructor role to read arbitrary files on the server by exploiting improper validation of stored file paths used for streaming media. This includes sensitive files such as the WordPress configuration file, which contains database credentials and authentication keys, potentially enabling cookie forgery.
CVE-2026-63042 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. It allows any authenticated user with access to the manager interface to create, modify, and delete Data Node definitions due to files or directories being accessible to external parties. This issue is addressed in Apache InLong version 2.4.0.
CVE-2026-63040 is a vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. The issue arises because the StreamSource component does not perform authorization checks, allowing any authenticated user to logically delete all stream sources. This vulnerability has a high severity score of 8.1 and impacts integrity and availability without affecting confidentiality. Users are advised to upgrade to version 2.4.0 or apply the specific patch referenced in the vendor's pull request to remediate the issue.
A path traversal vulnerability exists in handlebars.java versions prior to 4.5.3. The issue arises from improper validation of attacker-controlled Spring MVC view names in the SpringTemplateLoader component, allowing remote unauthenticated attackers to read arbitrary files accessible to the JVM. This vulnerability is fixed in version 4.5.3.
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Vault Secrets Operator versions 1.3.0 through 1.4.1 contain a vulnerability in the AppRole authentication configuration that allows tenants with limited Kubernetes RBAC permissions to read arbitrary files from the operator pod's filesystem and exfiltrate credentials. This can lead to privilege escalation within the Kubernetes cluster. The issue is fixed in version 1.5.0.
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API can read arbitrary local files, create or overwrite image and trace files, or delete files accessible to the Vitest process even when allowWrite is false. This issue is fixed in versions 3.2.7, 4.1.10, and 5.0.0-beta.6.
A vulnerability in the Paid Membership Subscriptions WordPress plugin before version 3.0.7 allows unauthenticated users to download exported member and payment data files. These files, containing personally identifiable information (PII), are written to a predictable location in the uploads directory without proper access protection. This exposure can occur while the export artifact is present on the server.