GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...

GHSA-PF2Q-PXHF-HGMW n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory

Impact The component @n8n/computer-use file-search tool confined searches to a configured base directory. A crafted search pattern could bypass the confinement check and expand to locations outside that directory, causing the tool to return the names and contents of files anywhere the daemon's OS...

External Control of File Name or Path

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to External Control of File Name or Path via the Edit Image. An attacker can write arbitrary files outside the intended directory by supplying crafted values to the output format parameter. Workaround...

GHSA-G7HG-VRCF-MVMR Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Summary OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Details In...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths in SVG images encoded as data-URI. An attacker can access arbitrary files from the server's filesystem by embedding a reference to a local file within a base64-encoded SVG image,...

GHSA-CX96-42PX-69FM Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...

CVE-2026-64796

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2025-60835

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...

GHSA-WVH6-F5JH-8GW4 Dompdf: Chroot Validation Bypass

Summary The chroot check for local files uses a prefix string check to enforce chroot boundaries. The simple string comparison it performs allows paths like /var/www/rootsecret/file.html when chroot is /var/www/root. This allows attacker-controlled document paths/resources to bypass intended loca...

CVE-2026-64796

CVE-2026-64796 concerns the Joomla Sourcerer extension by regularlabs.com, with multiple code injection vectors. The Free version allegedly lets both the article creator and last modifier execute article PHP without needing Super User privileges; the Pro version reportedly fails to consistently e...

CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

EUVD-2026-47811

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the...

GO-2026-6026 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser

File Browser: Archive builder turns backslash filenames into path traversal zip-slip in github.com/filebrowser/filebrowser...

CVE-2026-13089

OIDC::Lite for Perl up to 0.12.1 is vulnerable to ID Token signature verification bypass via an unpinned algorithm allowlist. If the caller does not pin the alg, verify uses the token header alg and passes it to decode_jwt with an allowlist from the untrusted token, allowing tokens with alg: none...

CVE-2026-55677

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

EUVD-2026-47791

A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a malformed OCSP response from a remote peer during the TLS handshake. OCSP stapling validation is enabled by default for outgoing TLS connections. Affected scenarios require the remote peer to hold a...

CVE-2026-65012

InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...

CVE-2026-50540

A flaw was found in Kata Containers, affecting both its Rust and Go runtimes. An authenticated pod user can exploit this by setting the io.katacontainers.configpath annotation to an arbitrary configuration file on the host. This allows the attacker to control privileged runtime settings, leading ...

SUSE CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

SUSE CVE-2026-59847

A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection...