CVE-2026-43637

Cornac before 2.6.0 is affected by a path traversal (Tar Slip) in the _extract_archive() function (cornac/utils/download.py). The vulnerability allows an attacker to write arbitrary files outside the intended cache directory by supplying crafted TAR archives with ../ sequences, absolute paths, or...

CVE-2026-61873

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

CVE-2026-61873

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

EUVD-2026-44621

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

CVE-2026-61873 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

CVE-2026-61873 Grav before 9.1.8 Arbitrary File Write via Twig-Processed Filename

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that a...

CVE-2026-61873

Grav before 9.1.8 is affected by an arbitrary file write in the Form plugin via the process.save.filename parameter. The parameter is path-traversal validated before Twig processing but not re-validated after rendering, enabling an attacker to submit form data that writes arbitrary files (includi...

Exploit for Improper Authentication in Google Android

BT-HID-PoC — CVE-2023-45866 Interactive Wizard DISCLAIMER...

Exploit for Deserialization of Untrusted Data in Metabase

CVE-2026-59827 — Unsafe Deserialization of H2 Query Results in...

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

SUSE CVE-2026-54911

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into different...

Race condition Apache Kafka Dependency in Bitbucket Data Center

This High severity Race condition vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bitbucket Data Center. This Race condition vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N allows an...

Race condition grunt Dependency in Bitbucket Data Center

This High severity Race condition vulnerability was introduced in version 10.3.0 of Bitbucket Data Center. This Race condition vulnerability, with a CVSS Score of 7 and a CVSS Vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H allows an authenticated attacker to modify code sequences in which...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the handling of XAPK archive entries with absolute paths in the XApkLoader file. An attacker can achieve arbitrary code execution by crafting a malicious .xapk file that causes files to be written outside the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ArchiveExtract function in cmd/archive/extract/extract.go, which strips only a leading ./ from archive entry paths and joins them to the destination with path.Join without removing .. components. An attacker c...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the ArchiveExtract function in cmd/archive/extract/extract.go, which strips only a leading ./ from archive entry paths and joins them to the destination with path.Join without removing .. components. An attacker c...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal allowing authorization bypass in the checkPrivate and WithRemote middleware in cmd/serve/restic/restic.go, where checkPrivate authorizes on the routed userID segment while WithRemote builds the backend object key fro...

perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and...

PT-2026-60275

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase export-center deletion can accept path traversal sequences such as ../ in the bulk delete API endpoint and pass attacker-controlled identifiers to ExportCenterManage.delete, allowing recursive deletion of...