110458 matches found
CVE-2026-85160
AVideo (through commit c91b5975d) is affected by a combined CSRF and path traversal vulnerability in stopLive.php . The root cause is missing token validation and unsanitized key parameter concatenation, allowing an attacker to craft a malicious image tag with a traversal payload (e.g., key=../.....
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
CVE-2026-85160 AVideo through c91b5975d CSRF and Path Traversal via stopLive.php
AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...
WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by nh4tvd in WordPress Plugin Business Directory versions = 6.4.26...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by sungbyeongchan in WordPress Plugin Business Directory versions = 6.4.26...
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
...
httpd mod_auth directory protection bypassed by a doubled slash in the request path
...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
Important: Red Hat Security Advisory: python3.12 security update
An update for python3.12 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
CVE-2026-74994
A flaw was found in the modauth module of OTP's inets httpd server. When configured with multiple directory configuration blocks and using dets or mnesia authentication backends, the module incorrectly collapses all directory blocks into a single shared user/group namespace. This allows a user...
CVE-2026-65109
Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI containe, Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern...
PT-2026-86455
Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description WebFig contains an unauthenticated file-read issue in the '/jsproxy' endpoint. A newly allocated session retains a stale...
Linux Distros Unpatched Vulnerability : CVE-2026-74994
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collaps...
PT-2026-85210
Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit aws-fpga before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path ...
PT-2026-85101
Unauthenticated Broken Access Control in Business Directory = 6.4.26 versions...
CVE-2026-83711: Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...