134854 matches found
CVE-2026-84311
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...
DEBIAN-CVE-2026-84311
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/page.py PageObject.extracttext and PageObject.extractxformtext to traverse a directed acyclic graph of reused form XObjects in which each form invokes a child multiple times,...
CVE-2026-73765
Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...
CVE-2026-73760
An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files...
CVE-2026-84310
A flaw was found in pypdf. A remote attacker could craft a malicious PDF document with specially designed outlines. Processing this document would cause the pypdf library to consume excessive processing time and memory, leading to a Denial of Service DoS condition. This vulnerability is due to a...
EUVD-2026-69629
Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...
CVE-2026-73765
Authenticated path traversal vulnerabilities in API endpoints of HPE AOS-CX (ArubaOS CX) allow an attacker with valid credentials to write arbitrary files to the underlying operating system, potentially leading to remote code execution . The CVSS v3.1 base score is 7.2 (HIGH) , reflecting network...
CVE-2026-73765 Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX
Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...
CVE-2026-73765 Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX
Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution...
EUVD-2026-69624
An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files...
CVE-2026-73760 Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX
An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files...
CVE-2026-73760 Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX
An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files...
CVE-2026-73760
An authenticated Path Traversal vulnerability in HPE AOS-CX allows an attacker with low privileges to read arbitrary files from the web-based management interface of the underlying operating system, potentially leading to remote unauthorized access to files. The CVSS 3.1 score is 6.5 (Medium) wit...
CVE-2026-84365
Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...
CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...
CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...
CVE-2026-84365
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...
CVE-2026-84365 Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG can still write files outside the configured output directory when a route parameter contains...
CVE-2026-78592
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...
CVE-2026-73737
An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations,...