AlmaLinux 9.2 [TuxCare] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1781080840)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1781080840 advisory. - The go tool pack subcommand usually used only by the compiler as an internal tool with known-good inputs does not sanitize output...

AlmaLinux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1783078783)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783078783 advisory. - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

PT-2026-103500

Name of the Vulnerable Software and Affected Versions yii2-starter-kit versions prior to 4.2.0 Description The software exposes the Yii debug and Gii modules to all IP addresses by setting the allowedIPs variable to '' in the default development configuration. Unauthenticated remote attackers can...

@xhmikosr/decompress: Path traversal via symlink chain

Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...

CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon Exploit version 25.0.1 GibbonEdu Gibbon version 25.0.1 et antérieure GibbonEdu Gibbon version 25.0.1 et antérieure permet l'écriture arbitraire de fichiers En savoir plus https://nvd.nist.gov/vuln/detail/CVE-2023-45878...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.22.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

DEBIAN-CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875 VLC media player before 3.0.24 Path Traversal via skins2

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102875

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2019-14751_PoC

CVE-2019-14751PoC Une preuve de concept pour CVE-2019-14751 Description de la vulnérabilité Le téléchargeur NLTK antérieur à la version 3.5 est vulnérable à une traversée de répertoire, permettant aux attaquants d'écrire des fichiers arbitraires via un ../ dot dot slash dans un paquet NLTK archiv...

npm-tar-path-traversal-scanner

CVE-2026-31802 — Сканер Path Traversal для npm-пакета tar Обнаруживает npm-пакеты, уязвимые к CVE-2026-31802 , — уязвимости обхода пути в npm-пакете tar, которая позволяет произвольную запись файлов во время извлечения архива. Возможности Сканирует package-lock.json на наличие уязвимых версий tar...

CVE-2021-33564

CVE-2021-33564 - Preuve de concept Script d'exploitation pour CVE-2021-33564 Injection d'arguments dans la gemme Ruby Dragonfly. Utilisation Lecture de fichier arbitraire python3 poc.py -u https:///system/refinery/images -r /etc/passwd Écriture de fichier arbitraire python3 poc.py -u...

CVE-2026-55168

CVE-2026-55168 Этот репозиторий содержит простой PoC для CVE-2026-55168 в Runtipi. Проблема представляет собой аутентифицированную произвольную запись файла, которую можно достичь через процесс восстановления из резервной копии. Специально сформированный архив резервной копии может внедрить симли...

EUVD-2026-89019

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...

CVE-2026-19743

The TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 are vulnerable to a Path Traversal flaw in the local IPC service. Due to improper path validation, a local authenticated user with low privileges can send crafted IPC commands to the service daemon to manipula...

CVE-2026-43637-cornac

CVE-2026-43637: Обход пути Tar Slip в Cornac через extractarchive Серьёзность: высокая, CVSS 4.0 8.8 , критическая, CVSS 3.1 9.1 присвоена VulnCheck, CNA Вектор v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Вектор v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Затронут...

FortiLPE

Description Exploit PoC d'escalade de privilèges locaux pour CVE-2025-62676 / EUVD-2025-206993 qui cible FortiClient VPN sur Windows. Exécute une charge utile dans le contexte de SYSTEM depuis un contexte utilisateur normal via une écriture arbitraire de fichier XML. Le PoC a été testé contre...