https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:55:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-94238 <p>The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9&#39;s translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.</p> <p>The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9&#39;s translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-94238 https://vulnerability.circl.lu/vuln/ghsa-m23q-3295-mh2g <p>The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9&#39;s translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.</p> <p>The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9&#39;s translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.</p> https://vulnerability.circl.lu/vuln/ghsa-m23q-3295-mh2g