CVE-2026-93751

uri-js through version 4.4.1 is affected by an improper UTF-8 decoding flaw in the pctDecChars() function. The function incorrectly decodes invalid and overlong percent-encoded sequences into ASCII metacharacters, allowing attackers to craft payloads that bypass platform decoder validation and in...

CVE-2026-93751 uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

GHSA-VR5F-W35Q-98JP Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

Perses's unvalidated project parameter enables filesystem path traversal

Impact When Perses is using the file system database, on the list endpoints, the project value is bound from the request into the resource Query struct and is never validated against directory-traversal characters validation/Flatten only runs for Create/Update bodies, not list queries. The path i...

EUVD-2026-83268

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-63445

Perses , an open-source observability dashboard, is affected by a filesystem path traversal vulnerability (CVSS 4.0: 7.1 HIGH ) in its list endpoints when the file-system database backend is active. The request-controlled project query parameter is bound into the resource Query struct without val...

CVE-2026-63445 Perses: Unvalidated project parameter enables filesystem path traversal

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2026-19264

CVE-2026-19264 - Postiz 中未经验证的路径遍历导致完全接管实例 作者： Krithik Babu P @DarkLycn1976 发布时间： 2026-08-10 CVE： CVE-2026-19264 严重性： 严重 - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE： CWE-22 - 对受限目录中路径名的限制不当 受影响版本： gitroomhq/postiz-app 2.22.1 修复版本： v2.22.1 TL;DR Postiz 通过一条路由提供本地存储的媒体文件，该路由将 URL...

ragflow-audit

ragflow-audit Herramienta de auditoría de tres vulnerabilidades de RAGFlow CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : detecta y explota SSTI - RCE en los componentes StringTransform / Message zipslip : detecta offline el path traversal Zip Slip de las entradas del zip apikey : deriva...

cybersecurity_portfolio

作品集。乌索利采夫·格列布 圣彼得堡彼得大帝理工大学计算机科学与网络安全学院二年级学生，专业方向 10.03.01「信息安全」。 在«Positive Technologies»股份公司进行教学（认知）实习期间，完成了两个实践案例。以下以技术材料形式给出这些案例的描述，未采用教学报告特有的排版格式。 实践工作由学习小组共同完成：班杜尔科 В. В.、乌索利采夫 Г. В.、乌斯季扬采夫 А. С. 案例 部署 SIEM Wazuh：检测 SSH 暴力破解 wazuh-siem-deployment 部署 Wazuh，创建自定义检测规则，配置索引模板，接入代理，并构建针对服务器的攻击可视化...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-77385

Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

CVE-2026-62278

LubeLogger is a self-hosted, open-source web-based vehicle maintenance and fuel mileage tracker. In versions prior to 1.6.8 , authenticated non-administrative users could exploit a path traversal in HandleTranslationFileUpload by crafting a malicious file name. The underlying cause is in Helper/F...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-62278 LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-64824-PoC

CVE-2026-64824 — Path traversal por enlace simbólico en la copia de seguridad y restauración de Home Assistant Core → RCE CVSS 8.4 Crítico · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Un atacante autenticado admin sube un tar de copia de seguridad manipulado. La ruta de restauración extrae el...

CVE-2026-66493

文件操作中的路径遍历（删除 / 复制 / 移动） PhocaCommander ≤ 6.1.3 — 已认证管理员可在 Web 根目录之外操作文件 摘要 PhocaCommander 的文件操作处理器从攻击者可控的 base64 编码参数（pathfrom、pathwhere）构造源路径和目标路径，且未进行任何路径包含验证。已认证的管理员可以删除、复制和移动 Web 服务器进程可访问的文件系统中的任意文件。 已在实验室中确认：可以删除 /tmp/（Web 根目录之外）中的文件，并将 /etc/passwd 复制到 PhocaCommander...