112743 matches found
CVE-2026-63134
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63177
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
CVE-2026-48763
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...
open-iscsi: open-iscsi: Privilege Escalation via Path Traversal
A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...
Important: Red Hat Security Advisory: iscsi-initiator-utils security, bug fix, and enhancement update
An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2026-48763
TypeBot prior to v3.17.0 exposes a deprecated public upload endpoint GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url that returns a presigned S3 PUT URL for an attacker-controlled filePath. An unauthenticated attacker who knows a valid public typebotId and blockId can obtain ...
CVE-2026-33922
A flaw was found in Arc. This path traversal vulnerability exists within the Offline archives functionality of the local web interface. A local user with administrative credentials can exploit this by submitting an archive name containing special characters, allowing them to delete arbitrary file...
CVE-2026-63177
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
EUVD-2026-56972
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access control enforced in the Nginx OpenResty Lua layer evaluates the raw, unnormalized ngx.var.requesturi, while Nginx itself routes requests using the normalized path. An authenticated low-privilege user can...
CVE-2026-63134
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134
Malcolm (network traffic analysis tool) is affected by a path-traversal vulnerability in the archive extraction code prior to v26.07.0. safe-extract.py uses libarchive secure flags but creates directories with os.makedirs(dest/entry.pathname) without traversal protection, allowing a malicious arc...
EUVD-2026-56971
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation
Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...
GHSA-3RRR-JR9J-H3Q3 vulnerabilities
Vulnerabilities for packages: langfuse...
GHSA-8J4G-W8FX-2239 vulnerabilities
Vulnerabilities for packages: langfuse...
CVE-2026-69207 vulnerabilities
Vulnerabilities for packages: langfuse...