OpenEMR versions prior to 8.2.0 contain a vulnerability where patient documents are stored with predictable filenames in a publicly accessible location. This allows unauthenticated actors who can guess or obtain the URL to access sensitive patient documents. The issue is fixed in version 8.2.0.
Apache OpenOffice documents can include multimedia content (audio, video, etc.)
A crafted document could exploit the GStreamer multimedia component of Apache OpenOffice version through 4.1.16 to load the contents of any local file, and include them when the document is saved or exported, for example as PDF.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
The flat file database driver in Apache Openoffice versions through 4.1.16 allows a crafted document to read the contents of any local file without asking the user.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
Apache Wicket versions 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0 have a vulnerability where developer-authored markup template files can be read by external parties under certain uncommon deployment configurations. This occurs when the wicket-core library is loaded by a class loader that cannot see the application's component classes, causing a check to fail and allowing the template files to be served. The exposure is read-only and does not disclose user data or credentials. Typical deployments with wicket-core and the application in the same class loader are not affected. Fixed versions are 8.20.0, 9.25.0, and 10.12.0.
CVE-2026-61730 is a critical vulnerability in socfortress CoPilot versions prior to 0.1.77. It allows unauthenticated access to the /scoutsuite-report static files directory, exposing sensitive cloud security reports and potentially private Google service-account JSON keys during scans. This exposure can lead to unauthorized access to AWS, Azure, and GCP IAM principals and resource inventories. The issue is fixed in version 0.1.77.
A vulnerability in Nuxt versions 4.6.0 through 4.6.2 allows an attacker with HTTP access to a development server to retrieve a generated appSecret file. This secret can be used to derive session passwords and forge session cookies, potentially compromising session integrity. The issue is limited to development servers bound to localhost and does not affect production builds or servers with explicitly configured appSecrets. The vulnerability is fixed in version 4.6.3.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
CVE-2026-65210 is a vulnerability in the SMCI MBD-X12SPI product that allows an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem. This access goes beyond the intended IPMI management role, potentially exposing sensitive information. The vulnerability affects version 01.07.20 of the product. It has a medium severity with a CVSS score of 4.9. No public exploits or patches are currently documented.
CVE-2026-46651 is a critical vulnerability in intranda goobi-viewer-core versions 24.03 up to but not including 26.05. The DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) accepts download requests from unauthenticated users, allowing unauthorized access to critical functionality. This flaw has been fixed in version 26.05.
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 contain a vulnerability in CombinedResourceHandler where it accepts a structurally valid deflated and base64 encoded combined resource ID without verifying its authenticity. This allows attackers to forge IDs that can cause unbounded decoded output, memory exhaustion, and limited disclosure of Facelets source files. Additionally, in certain configurations, a forged ID can trigger a blind server-side fetch influenced by the request Host header. The issue is fixed in the stated versions.
CVE-2026-108070 is a high-severity vulnerability in TSplus Remote Access version 19.20.3.10. It involves improper access control in the web server component, allowing unauthenticated remote attackers to bypass intended access restrictions and access internal resources by manipulating paths through the /socket.io/JWN/ endpoint.
CVE-2026-96857 is a vulnerability in the Windows Projected File System on Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to disclose information by accessing files or directories that should not be externally accessible. The issue affects multiple Windows 10 versions prior to specific fixed builds. A patch is available and has been officially released by Microsoft.
CVE-2026-88137 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds where files or directories accessible via WebDAV can be disclosed to external parties by an authorized attacker over a network. This issue allows information disclosure without user interaction. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Official patches have been released to address this issue in multiple Windows 10 builds.
CVE-2026-85840 is a vulnerability in Microsoft Windows 10 Version 1607 and other specified versions where files or directories are accessible to external parties via Windows Event Viewer. This flaw allows an authorized attacker to disclose sensitive information over a network without user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.5 and has been officially fixed in multiple Windows 10 builds.
CVE-2026-85812 is a vulnerability in the Windows Bind Filter Driver of Microsoft Windows 10 Version 21H2 that allows an authorized local attacker to disclose information by accessing files or directories that should not be externally accessible. The flaw affects multiple builds of Windows 10 21H2 and related versions prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.5. Microsoft has released official fixes for all affected versions.
TYPO3 CMS versions 14.0.0 through 14.3.8 contain a vulnerability where forms using FileUpload or ImageUpload elements with a custom saveToFileMount setting incorrectly store uploaded files in the default public storage folder instead of the intended restricted storage. This misplacement causes uploaded files to be publicly accessible without the intended access controls. Forms using the default saveToFileMount value are not affected.
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
The Order Export & Order Import for WooCommerce plugin for WordPress up to version 2.7.8 is vulnerable to sensitive information exposure. Unauthenticated attackers can access exported order CSV files containing customer personally identifiable information (PII) such as names, addresses, emails, phone numbers, and order details. This occurs when protective .htaccess and index.php files are missing from the export directory, a state that can arise after uninstall/reinstall cycles, migrations, backup restores, or staging synchronizations. Export filenames are predictable based on timestamps, enabling brute-force access to files over HTTP without authentication.
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.