9493 matches found
CVE-2026-25825: Use of Incorrectly-Resolved Name or Reference
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...
PT-2026-92126
Name of the Vulnerable Software and Affected Versions containers/storage library affected versions not specified Description A flaw in the containers/storage library allows a crafted tar archive containing a malicious whiteout header e.g. victim/.wh. to replace the extraction destination director...
CVE-2026-91940: Improper Limitation of a Pathname to a Restricted Directory
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filteruntrustedfields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious imagesavedir paths to write attacker-controlled...
CVE-2026-25825
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...
PT-2026-92026
Name of the Vulnerable Software and Affected Versions Keyfactor SignServer versions prior to 7.6.0 Description An issue exists where the output file used by the SignerStatusReportWorker for logging reports can be configured to any path, including those of existing files. This allows a user with...
EUVD-2026-78627
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...
RockyLinux 9 : rsync (RLSA-2026:67462)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67462 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...
CVE-2026-40058: Time-of-check Time-of-use (TOCTOU) Race Condition
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...
PT-2026-92059
crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the filter untrusted fields function fails to validate untrusted configuration fields. Attackers can submit crafted config bodies with malicious image save dir paths to write attacker-controll...
CVE-2026-25825
An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...
PT-2026-92186
Name of the Vulnerable Software and Affected Versions Falcon sensor for Windows versions prior to 8.10.21408 Falcon sensor for Windows versions prior to 7.40.21309 Falcon sensor for Windows versions prior to 7.39.21113 Falcon sensor for Windows versions prior to 7.38.21007 LTS Falcon sensor for...
CVE-2026-91934: Improper Limitation of a Pathname to a Restricted Directory
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-84534
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...
CVE-2026-84534
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...
EUVD-2026-78126
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...
CVE-2026-84534
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...
CVE-2026-84534
A path handling issue exists in several Apple products, where extracting a maliciously crafted archive may allow an attacker to write arbitrary files . This vulnerability is addressed with improved validation and is fixed in iOS 26.7 , iPadOS 26.7 , iOS 27 , iPadOS 27 , macOS Golden Gate 27 , mac...
CVE-2026-84598
A path traversal issue in iOS and iPadOS allows an attacker with physical access to a trust-paired device to read and write arbitrary files . The vulnerability stems from insufficient path validation and has been addressed in iOS 26.7 , iPadOS 26.7 , iOS 27 , and iPadOS 27 . No specific exploit d...
CVE-2026-50006
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...