EUVD-2026-57611

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

EUVD-2026-57610

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-68930 vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-M65R-RPRJ-R5RG vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-CQJC-RMPQ-XPRQ vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-RP2P-6CMP-JXJ9 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-WP74-JGXH-GV4Q vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-G9HV-X236-4QP3 vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-CQJC-RMPQ-XPRQ vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-M65R-RPRJ-R5RG vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-50528 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-QVW7-JM5C-6HQW vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-74JP-VM22-8Q8X vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-W7CW-XP7H-6J5J vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-73409

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

CVE-2026-72802

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodified to CheckAuth-only requests. Attackers can harvest relative asset paths from published documents and submit them to resolveAssetPath to...

CVE-2026-72799

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...

CVE-2026-16033 Arbitrary file read+write on host via templates/ symlink in malicious image

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-16033

CVE-2026-16033 describes a path traversal vulnerability in LXD. When processing image metadata templates, LXD fails to sanitize or restrict template file paths from escaping the instance templates directory, specifically affecting VM/QEMU driver execution paths. An attacker can supply a crafted i...