CVE-2025-41756: Inclusion of Undocumented Features or Chicken Bits

A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitrary files on the system...

CVE-2026-29780

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows...

CVE-2026-29778 pyLoad: Arbitrary File Write via Path Traversal in edit_package()

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...

CVE-2026-29778 pyLoad: Arbitrary File Write via Path Traversal in edit_package()

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...

CVE-2026-29778 pyLoad: Arbitrary File Write via Path Traversal in edit_package()

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...

CVE-2026-29778

pyLoad: Arbitrary File Write via Path Traversal in edit_package() is confirmed. Affected range: 0.5.0b3.dev13–0.5.0b3.dev96; fix patched in 0.5.0b3.dev97. The issue stems from insufficient sanitization of pack_folder, relying on a single-pass "../" replacement, which can be bypassed by crafted re...

CVE-2026-29780 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows...

CVE-2026-29780

Summary: CVE-2026-29780 affects the Python eml_parser library. The vulnerability resides in the official example script (examples/recursively_extract_attachments.py), where attachment filenames are used directly to build output paths without sanitization, enabling an attacker-controlled filename ...

CVE-2026-29780 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows...

CVE-2026-29780 eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the ajaxdeletefile function. An attacker can delete arbitrary files on the server by sending crafted requests as an authenticated user with Contributor-level access or higher. This can result in the deletion of...

Path Traversal

bentoml is vulnerable to path traversal. The vulnerability is due to improper validation of symlink targets in the safeextracttarfile function, which allows an attacker to craft a malicious tar file containing a symlink pointing outside the extraction directory and subsequently write files throug...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the /export endpoint. An attacker can access arbitrary files on the server filesystem, including sensitive configuration files containing secrets, by sending specially crafted requests with double-encoded travers...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the /export endpoint. An attacker can access arbitrary files on the server filesystem, including sensitive configuration files containing secrets, by sending specially crafted requests with double-encoded travers...

EMLParser path traversal vulnerability

EMLParser is an open-source Python library for parsing email files developed by GOVCERT.LU. Versions of EMLParser prior to 2.0.1 contained a path traversal vulnerability. This vulnerability occurred because the sample scripts did not clean up the names of attachment files, allowing arbitrary file...

CVE-2026-29780: Improper Limitation of a Pathname to a Restricted Directory

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script examples/recursivelyextractattachments.py contains a path traversal vulnerability that allows...

Directory Traversal

Overview dbt-common is a The shared common utilities that dbt-core and adapter implementations use Affected versions of this package are vulnerable to Directory Traversal via the safeextract function. An attacker can write files outside the intended extraction directory by supplying a malicious...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the archive extraction process. An attacker can access or modify arbitrary files on the system by crafting a package containing symlinks that point outside the intended destination directory. Details A Directory...

Arbitrary File Write via Validation/Extraction Path Mismatch in nltk.downloader._unzip_iter()

Description The current Zip Slip hardening in nltk.downloader.validatemember assumes that the path validated with: os.path.abspathos.path.joinroot, member os.path.realpathos.path.joinroot, member is the same path that zipfile.extractmember, root will later write to. That assumption is false for...

OESA-2026-1487 hsqldb security update

HSQLdb is a relational database engine written in JavaTM , with a JDBC driver, supporting a subset of ANSI-92 SQL. It offers a small about 100k, fast database engine which offers both in memory and disk based tables. Embedded and server modes are available. Additionally, it includes tools such as...