Linux svc_exportPut DoS

The vulnerability of the svcexportput function in the Linux operating system’s kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-31956: Authorization Bypass Through User-Controlled Key

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authenticated user can manually construct a URL to preview campaigns/regions, and export saved reports belonging to other users. Exploitation of th...

EUVD-2026-25266

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies...

CLSA-2026-1776965055 Fix CVE(s): CVE-2025-32988, CVE-2025-32990

SECURITY UPDATE: heap buffer overflow in certtool template parsing - debian/patches/CVE-2025-32990.patch: use callocMAXENTRIES + 1 instead of mallocMAXENTRIES in READMULTILINE and READMULTILINETOKENIZED macros in src/certtool-cfg.c. - CVE-2025-32990 SECURITY UPDATE: double free when exporting...

CVE-2026-41231

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

EUVD-2026-25182

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

CVE-2026-41231

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

CVE-2026-41231 Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

CVE-2026-41231 Froxlor has Incomplete Symlink Validation in DataDump.add() that Allows Arbitrary Directory Ownership Takeover via Cron

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixedhomedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

PT-2026-34707

Name of the Vulnerable Software and Affected Versions OpenTelemetry dotnet versions 1.13.1 through 1.15.1 Description When exporting telemetry to a back-end or collector over gRPC or HTTP using the OpenTelemetry Protocol OTLP format, unsuccessful requests HTTP 4xx or 5xx result in the response...

PT-2026-34635

Froxlor is open source server administration software. Prior to version 2.3.6, DataDump.add constructs the export destination path from user-supplied input without passing the $fixed homedir parameter to FileDir::makeCorrectDir, bypassing the symlink validation that was added to all other...

OpenTelemetry .NET 安全漏洞

OpenTelemetry .NET is the .NET client of OpenTelemetry developed by OpenTelemetry Inc. Versions of OpenTelemetry .NET from 1.13.1 to 1.15.2 contained a security vulnerability. This vulnerability stemmed from the unlimited response reading during the OTLP protocol export process, which could lead ...

SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

Summary The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check IsSensitivePath but did not address the root cause — a redundant url.PathUnescape call in serveExport. An authenticated attacker can use double URL encoding %252e%252e to traverse directories and read arbitrary...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the serveExport process. An attacker can access and exfiltrate sensitive files, including databases and logs, by sending specially crafted requests with double URL encoding to bypass path validation. Details A...

GHSA-HJH7-R5W8-5872 SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)

Summary The fix for CVE-2026-30869 in SiYuan v3.5.10 only added a denylist check IsSensitivePath but did not address the root cause — a redundant url.PathUnescape call in serveExport. An authenticated attacker can use double URL encoding %252e%252e to traverse directories and read arbitrary...

poetry-plugin-export (>=1.0.7, <=1.1.1), poetry-plugin-tweak-dependencies-version (0.1.0) potentially affected by CVE-2026-41140 via poetry (1.2.1)

poetry PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - poetry-plugin-export =1.0.7, =1.1.1 - poetry-plugin-tweak-dependencies-version 0.1.0 Source cves: CVE-2026-41140 Source advisory:...

distill-trainer (>=0.1.0, <=0.1.1), poetry-plugin-export (1.3.1) +1 more potentially affected by CVE-2026-41140 via poetry (1.5.0)

poetry PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - distill-trainer =0.1.0, =0.1.1 - poetry-plugin-export 1.3.1 - wolf-core 2.0.1 Source cves: CVE-2026-41140 Source advisory: OSV:GHSA-73H3-MF4W-8647...

pab (>=2.5.5, <=2.8.1), poetry-alias (0.1.0) +2 more potentially affected by CVE-2026-41140 via poetry (1.2.0b3)

poetry PYPI version 1.2.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - pab =2.5.5, =2.8.1 - poetry-alias 0.1.0 - poetry-plugin-export 1.0.5 - poetry-scaffold-plugin 0.1.0 Source cves: CVE-2026-41140 Source advisory:...

poetry-plugin-export (1.0.4) potentially affected by CVE-2026-41140 via poetry (1.2.0b2)

poetry PYPI version 1.2.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - poetry-plugin-export 1.0.4 Source cves: CVE-2026-41140 Source advisory: OSV:GHSA-73H3-MF4W-8647...

EUVD-2026-24682

The Ni WooCommerce Order Export plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.1.6. This is due to missing nonce validation in the niorderexportaction AJAX handler function. The handler processes settings updates when the 'page' parameter is...