30583 matches found
SUSE SLES16 Security Update : apache-ivy (SUSE-SU-2026:22858-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22858-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow...
PT-2026-65513
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
PT-2026-65607
Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.59.0 through 0.61.0 Description When generating Python data models from an XML Schema using the --input-file-type xmlschema option, the software improperly resolves schemaLocation values within , , , and...
CVE-2026-54545: Improper Limitation of a Pathname to a Restricted Directory
wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli sanitizes bundle-controlled module filenames only once before writing extracted modules, so a crafted filename containing overlapping traversal sequences such as ....// collapses to ../ after sanitizatio...
CVE-2026-59921: Improper Neutralization of CRLF Sequences
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without...
Malicious code in selparsecss-selector (npm)
Source: amazon-inspector f4f8e230628f3622bf88bcd590f98f8065a99ea3e71ef1bf3c330439b7671e1f [email protected] is a name-confusion fork of postcss-selector-parser: package.json declares author 'Ai Pyramid' while the LICENSE-MIT, source tree, API, and CHANGELOG are copied verbatim from the...
Directory Traversal
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the existingimage field during category updates. An attacker can delete arbitrary files by exploiti...
Directory Traversal
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the existingimage field during category updates. An attacker can delete arbitrary files by exploiti...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...
CVE-2026-65921
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
CVE-2026-65921 Potential path traversal leading to unauthorized file writes
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
CVE-2026-65921 Potential path traversal leading to unauthorized file writes
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
CVE-2026-65921
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
EUVD-2026-49569
A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...
CVE-2026-65921
Technical details, including affected product/version, root cause, and remediation, are not publicly available in the provided documents; monitor for updates.
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...
CVE-2026-64647 Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodies
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...
CVE-2026-64647
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...
EUVD-2026-49404
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...