CVE-2026-93751

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-62278

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2025-10951

CVE-2025-10951 - checkmlloggertraversal.py 本工具用于验证 CVE-2025-10951 / GHSA-8x9j-2p8r-7xc6 是否存在——这是 geyang/ml-logger（≤ 0.10.36）中的一个未认证路径遍历漏洞，影响 mllogger/server.py 中的 loghandler / streamhandler 函数。 仅可用于你获得授权测试的系统。 检测内容...

two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal en el controlador de descargas de TECNO Hi Browser Prueba de concepto para CVE-2026-18907 CVSS 7.5 High, CWE-23, una vulnerabilidad de path traversal relativo en la funcionalidad de descarga de archivos de TECNO Hi Browser com.talpa.hibrowser versión 2.23.1.1. El...

CVE-2026-93751

uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...

CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

EUVD-2026-83268

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445

Perses , an open-source observability dashboard, is affected by a filesystem path traversal vulnerability (CVSS 4.0: 7.1 HIGH ) in its list endpoints when the file-system database backend is active. The request-controlled project query parameter is bound into the resource Query struct without val...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-19264

CVE-2026-19264 - Postiz 中未经验证的路径遍历导致完全接管实例 作者： Krithik Babu P @DarkLycn1976 发布时间： 2026-08-10 CVE： CVE-2026-19264 严重性： 严重 - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE： CWE-22 - 对受限目录中路径名的限制不当 受影响版本： gitroomhq/postiz-app 2.22.1 修复版本： v2.22.1 TL;DR Postiz 通过一条路由提供本地存储的媒体文件，该路由将 URL...

ragflow-audit

ragflow-audit Herramienta de auditoría de tres vulnerabilidades de RAGFlow CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : detecta y explota SSTI - RCE en los componentes StringTransform / Message zipslip : detecta offline el path traversal Zip Slip de las entradas del zip apikey : deriva...

cybersecurity_portfolio

作品集。乌索利采夫·格列布 圣彼得堡彼得大帝理工大学计算机科学与网络安全学院二年级学生，专业方向 10.03.01「信息安全」。 在«Positive Technologies»股份公司进行教学（认知）实习期间，完成了两个实践案例。以下以技术材料形式给出这些案例的描述，未采用教学报告特有的排版格式。 实践工作由学习小组共同完成：班杜尔科 В. В.、乌索利采夫 Г. В.、乌斯季扬采夫 А. С. 案例 部署 SIEM Wazuh：检测 SSH 暴力破解 wazuh-siem-deployment 部署 Wazuh，创建自定义检测规则，配置索引模板，接入代理，并构建针对服务器的攻击可视化...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-77385

Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...