10474 matches found
NPM: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
NPM: Flowise: Authenticated arbitrary file write in the S3 Directory document loader via unsanitized S3 object keys vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Summary Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.jointempDir, key and writes...
GHSA-88PR-878C-24WF Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys
Summary Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.jointempDir, key and writes...
CVE-2026-58072
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...
CVE-2026-58072
CVE-2026-58072 : The vulnerability affects the Veeam Service Provider Console. It enables arbitrary file write on the management server, which can lead to remote code execution. The CVSS v4.0 score is 9.0 (CRITICAL) with network attack vector, no user interaction, and high impacts on confidential...
CVE-2026-58072
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...
CVE-2026-58072
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...
CVE-2026-58072
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...
Security update for spice-vdagent
This update for spice-vdagent fixes the following issues: CVE-2026-57965: integer overflow in udscswrite can lead to heap buffer overflow bsc1269553. CVE-2026-57966: improper sanitization allows a compromised SPICE host to write arbitrary files to any location on the guest operating system...
Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Summaryimage.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both th...
PYSEC-2026-3568 Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Summary image.download fetches a URL and writes the response to disk. It does not use the central path guard validatepathwithenvconfig, which confines writes to FLYTOSANDBOXDIR; instead it confines the output to outputdir, but outputdir is itself a caller parameter. Since the attacker sets both t...
PYSEC-2026-3606 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...
Exploit for CVE-2026-52680
CVE-2026-52680 — Apache Kyuubi REST Batch Path-Traversal Arbit...
CVE-2026-18759
The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...
PT-2026-75949
Summary Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using path.jointempDir, key and writes...
PT-2026-67758
Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description A flaw allows an attacker to perform an arbitrary file write on the management server, which can potentially lead to remote code execution RCE, a situation where an...
PT-2026-67793
Name of the Vulnerable Software and Affected Versions NVIDIA Triton Inference Server for Linux affected versions not specified Description An issue exists in the Triton MLflow plugin where providing a specific path in the model name allows a user to read, write to, or modify files located outside...
PT-2026-105547
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...
CVE-2026-47764: Improper Limitation of a Pathname to a Restricted Directory
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
CVE-2026-58072: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...