crawl4ai CVE-2026-91940 arbitrary file write

CVE-2026-91940 crawl4ai 0.9.3: POST /crawl with PDFContentScrapingStrategy and attacker-controlled imagesavedir writes extracted image streams to disk. Hosts a minimal PDF on lhost:lport and triggers /crawl. Patched versions return HTTP 400 not permitted. Requires API token on 0.9.2. !/usr/bin/en...

ImageMagick CVE-2022-44268 PNG profile file read

CVE-2022-44268 ImageMagick = 7.1.0-49: tEXt profile chunk treats value as filename; leaked bytes appear in output PNG when the app processes attacker PNG upload + download workflow. !/usr/bin/env python3 -- coding: utf-8 -- """ImageMagick CVE-2022-44268 PNG profile arbitrary file read.""" from...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

EUVD-2026-109997

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-116612

A flaw exists in GStreamer Editing Services (gst-editing-services) where a GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When loaded by an editing application, media player, or file-manager thumbnailing service (via autoplugging), the pipeline is ...

CVE-2026-116612

A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager...

CVE-2026-115908

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...

CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...

CVE-2026-115908

The zip library for Rust (versions 7.2.0 through 9.0.0 ) is vulnerable to an arbitrary file write due to a regression in how symbolic links are validated. Specifically, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use lexical prefix comparisons instead of resolving each intermed...

CVE-2026-115908 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extractunwrappedrootdir use safepreparepath in src/read/zipfile.rs and simplifiedcomponents in src/path.rs to validate symbolic link targets with a lexical...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905

The zip library for Rust (through version 9.0.4 ) is vulnerable to a critical parser differential and security control bypass caused by dual-header inconsistencies, often referred to as Zip Cloaking . The root cause resides in src/read/stream.rs, where ZipArchive treats Central Directory File Hea...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in...

CVE-2026-93328

The Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox ) versions 1.2.0 through 1.4.0 contains a Path Traversal and Missing Authorization vulnerability in the cloud-storage source . An unauthenticated remote attacker can exploit this by using crafted tool invocation parameters to exfi...

CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases googleapis/mcp-toolbox versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwrite arbitrary local...

CVE-2026-116213

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

CVE-2026-115194

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server...