CVE-2026-18465
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to una
CVSS
6.5
Medio
EPSS
0.2%
p16
KEV
—
Exploit Today
5
0-100
Publicado: 9 ago 2026 · Última mod.: 26 ago 2026 · CWE-22
0.2%EPSS · 30 días0.3%
2026-08-092026-08-28
The WP MAPS PRO WordPress plugin before 6.1.3 does not perform a capability check in one of its AJAX actions, which is also available to unauthenticated users, and does not properly validate a user-controlled path before using it in a file inclusion, allowing unauthenticated attackers to include and execute arbitrary existing local PHP files on the server.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-188997.5 ALT—
——0IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.20hCVE-2026-822868.6 ALT—
——0gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs.22hCVE-2026-822757.5 ALT—
——0Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process.22hCVE-2026-822646.8 MED—
——0Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.20hCVE-2026-555696.6 MED—
——0aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.22hCVE-2026-555527.5 ALT—
——0Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.22h