gcdRadar
tags/Attack types

arbitrary-file-read

1 live · 25 on record · last incident 6 days ago

Dec ’25records per month, by first reportNov ’26

Live1

  1. live
    Ruby on Rails Active Storage Ruby on Rails Vulnerable to Arbitrary File Read and Write in Active Storage

    Patch now · Disclosed · since 4 Nov 2026

    An ImageMagick integration flaw in Ruby on Rails Active Storage allows attackers to write and read arbitrary files. This could enable threat actors to gain unauthorized file access and move laterally.

    Do:Check for vendor updates and apply patches for Ruby on Rails Active Storage.

Earlier24

  1. closed8.1
    Langflow CVE-2026-97677: IBM Langflow OSS Arbitrary File Read and Write

    Patch now · Disclosed · since 8 Nov 2026 · CVE-2026-97677

    AI
  2. closed8.1
    LiteLLM LiteLLM: internal_user_viewer arbitrary local file read via vertex_ai_credentials

    Patch now · Disclosed · since 27 Oct 2026

    AI
  3. closed7.1
    Langflow CVE-2026-105699: Langflow Authenticated Cross-Project File Disclosure

    Patch now · Disclosed · since 5 Oct 2026 · updated 7 Oct 2026 · CVE-2026-105699

    AI
  4. closed8.3
    MCP servers & tools CVE-2026-77260: MCP Atlassian accepts unconstrained file paths in upload handler

    Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77260

    AI
  5. closed8.6
    MCP servers & tools CVE-2026-77248: Unauthenticated file read and exfiltration in MCP Atlassian

    Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77248

    AI
  6. closed8.6
    MCP servers & tools CVE-2026-77255: MCP Atlassian Arbitrary File Read and Exfiltration Vulnerability

    Patch now · Disclosed · since 22 Sep 2026 · CVE-2026-77255

    AI
  7. closed6.5
    vLLM CVE-2026-73560: vLLM multimodal processor vulnerable to arbitrary file reads and SSRF

    Patch now · Disclosed · since 17 Aug 2026 · updated 8 Sep 2026 · CVE-2026-73560

    AI
  8. closed6.2
    gemini-bridge CVE-2026-54785: Local file read vulnerability in gemini-bridge MCP server

    Patch now · Disclosed · since 31 Jul 2026 · CVE-2026-54785

    AI
  9. closed7.5
    Langflow CVE-2026-7872: IBM Langflow Arbitrary File Read and Token Forgery

    Patch now · Disclosed · since 17 Jul 2026 · CVE-2026-7872

    AI
  10. closed2.1
    LiteLLM CVE-2026-59819: LiteLLM Local File Read Vulnerability

    Patch now · Disclosed · since 22 Jul 2026 · updated 22 Jul 2026 · CVE-2026-59819

    AI
  11. closed8.7
    Gradio Gradio FileExplorer Path Traversal Vulnerability CVE-2026-49119

    Patch now · Disclosed · since 1 Jul 2026 · CVE-2026-49119

    AI
  12. closed6.1
    Langflow CVE-2026-48520: Langflow arbitrary local or S3 file read vulnerability

    Patch now · Disclosed · since 16 Jun 2026 · updated 23 Jun 2026 · CVE-2026-48520

    AI
  13. closed
    Flowise Flowise Arbitrary File Read

    Patch now · Disclosed · since 15 Sep 2025

    AI
  14. closed7.5
    LLaVA CVE-2024-12065: Local file inclusion vulnerability in LLaVA gradio UI

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-12065

    AI
  15. closed6.5
    ChuanhuChatGPT CVE-2024-10707: Local file inclusion vulnerability in ChuanhuChatGPT

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10707

    AI
  16. closed5.3
    LangChain family CVE-2024-10940: LangChain-core arbitrary file read vulnerability

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10940

    AI
  17. closed6.9
    Gradio CVE-2024-51751: Arbitrary file read vulnerability in Gradio components

    Patch now · Disclosed · since 6 Nov 2024 · CVE-2024-51751

    AI
  18. closed5.8
    LocalAI CVE-2024-6095: SSRF and LFI vulnerability in LocalAI models apply endpoint

    Patch now · Disclosed · since 6 Jul 2024 · CVE-2024-6095

    AI
  19. closed9.1
    LoLLMs CVE-2024-4315: Lollms Local File Inclusion vulnerability

    Patch now · Disclosed · since 12 Jun 2024 · CVE-2024-4315

    AI
  20. closed7.5
    Gradio CVE-2024-4941: Local file inclusion in Gradio JSON component

    Patch now · Disclosed · since 6 Jun 2024 · CVE-2024-4941

    AI
  21. closed9.8
    Qdrant CVE-2024-3829: Input validation failure in Qdrant snapshot recovery

    Patch now · Disclosed · since 3 Jun 2024 · CVE-2024-3829

    AI
  22. closed
    Gradio Gradio Local File Inclusion Vulnerability in UploadButton

    Patch now · Disclosed · since 10 Apr 2024

    AI
  23. closed7.5
    Stable Diffusion WebUI CVE-2023-46315: Local file read vulnerability in Stable Diffusion Infinite Image Browsing extension

    Patch now · Disclosed · since 22 Oct 2023 · CVE-2023-46315

    AI
  24. closed7.3
    Gradio CVE-2023-34239: Gradio arbitrary file read and URL proxying vulnerabilities

    Patch now · Disclosed · since 9 Jun 2023 · updated 9 Jun 2023 · CVE-2023-34239

    AI