EUVD-2026-58477

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...

CVE-2026-73480

CVE-2026-73480 affects gdu. The issue is that gdu fails to strip terminal escape sequences from directory and file names when printing paths after exiting the TUI, allowing attackers to craft names with escape sequences that a terminal may interpret. This can enable title spoofing, clipboard mani...

CVE-2026-73429 vulnerabilities

Vulnerabilities for packages: yazi...

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...

EUVD-2026-40240

nltk: Arbitrary File Read via Path Traversal in nltk.data.load through Percent-Encoded Sequences...

EUVD-2026-58459

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths...

CVE-2026-17482

IBM Documentation Offline (versions 1.0.0–1.4.1) is affected by CVE-2026-17482: improper control of file paths in the embedded server could allow a remote attacker to execute arbitrary code. Impact is high (CVSS 3.1: 9.8; NETWORK, NONE user interaction). The vulnerability is tied to external cont...

EUVD-2026-58456

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-17473

IBM Documentation Offline 1.0.0–1.4.1 is affected by CVE-2026-17473: information disclosure via path traversal caused by improper limitation of a pathname to a restricted directory. A remote attacker could read arbitrary files. CVSS v3.1 base score 7.5 (HIGH). Remediation: upgrade to 1.5.1.

CVE-2026-17473 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-73429 vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-73430 vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-73498 vulnerabilities

Vulnerabilities for packages: mcp-atlassian...

CVE-2026-17088 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

EUVD-2026-58397

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-17088

IBM i versions 7.3–7.6 are affected by CVE-2026-17088 in Digital Certificate Manager. A path traversal vulnerability could allow a remote authenticated attacker to obtain sensitive information. CVSS 3.1 base score 4.3 (N: network, L: low confidentiality impact, PR: Low). Remediation is via IBM i ...

CVE-2026-17071

CVE-2026-17071 affects IBM i 7.3–7.6. A remote authenticated attacker can perform file manipulation due to a path traversal flaw in Digital Certificate Manager. The vulnerability is rooted in improper path handling, enabling manipulation of files when authenticated over the network. Affected IBM ...

CVE-2026-17071 IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal...

EUVD-2026-58392

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal...

CVE-2026-72677

Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored...