EUVD-2026-83440

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...

Improper Encoding or Escaping of Output

Overview uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars, which decodes invalid and overlong percent-encoded sequences in...

CVE-2026-82896 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

EUVD-2026-83411

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...

CVE-2026-82896

IBM Guardium Data Protection 12.2 is affected by a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to traverse directories on the system. The vulnerability carries a CVSS 3.1 score of 7.6 (HIGH) with low confidentiality impact, high integrity impact, and low avai...

EUVD-2017-19014

Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...

CVE-2017-20284

Caucho Resin contains a path traversal vulnerability in the resin-doc documentation webapp, specifically through the jndi-appconfig tutorial servlet. By supplying directory traversal sequences in the inputFile request parameter, remote unauthenticated attackers can read arbitrary files outside th...

Exploit for CVE-2026-45140

abraxaslabs.tech · github.com/abraxas ·&...

DEBIAN-CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2025-10951

CVE-2025-10951 - checkmlloggertraversal.py 本工具用于验证 CVE-2025-10951 / GHSA-8x9j-2p8r-7xc6 是否存在——这是 geyang/ml-logger（≤ 0.10.36）中的一个未认证路径遍历漏洞，影响 mllogger/server.py 中的 loghandler / streamhandler 函数。 仅可用于你获得授权测试的系统。 检测内容...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal en el controlador de descargas de TECNO Hi Browser Prueba de concepto para CVE-2026-18907 CVSS 7.5 High, CWE-23, una vulnerabilidad de path traversal relativo en la funcionalidad de descarga de archivos de TECNO Hi Browser com.talpa.hibrowser versión 2.23.1.1. El...

CVE-2026-93751

uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...

CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

EUVD-2026-83268

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...