CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser
Apache Roller 6.1.5 parses trackback responses with XXE enabled, exposing server files.
Stories per day · 30 days
1 RSS
4 stories, newest first · one card per story
Stories tagged #file-disclosure
CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
Dancer2 before 2.2.0 can serve files outside public_dir via relative path segments.
Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server
Wordfence Argus disclosed a critical CVSS 9.8 flaw in libheif enabling protected-file disclosure and code execution on vulnerable server deployments.
Flextype v1.0.0-alpha.3 Path Traversal in Entry Copy Allows Arbitrary Directory Copy and File Disclosure
Flextype CMS v1.0.0-alpha.3 entries copy endpoint accepts path traversal in source and destination parameters, enabling arbitrary directory copies and file disclosure.