CVE-2026-76344

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76832 Agno PythonTools Path Traversal via joinpath file_name argument

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

CVE-2026-76832 Agno PythonTools Path Traversal via joinpath file_name argument

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

CVE-2026-76832

CVE-2026-76832 is a path traversal vulnerability in Agno 's PythonTools (libs/agno/agno/tools/python.py). The file_name argument in the read_file, save_to_file, and run_python_file tool actions does not properly sanitize parent-directory traversal sequences, allowing an attacker to escape the int...

GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...

CVE-2026-63123

In TinaCMS CLI before 2.5.2, the Vite dev server CORS handler returns false for disallowed origins without rejecting the request, allowing cross-origin POST /media/upload/* to write attacker-controlled files into the dev server's media root. A remote attacker exploits this by luring a developer t...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-76358

In Splunk SOAR versions below 8.6.0, the app-installation archive extraction routine fails to validate extracted file paths, allowing users with app-install privileges to write files outside the intended temporary directory, enabling arbitrary file overwrite (HIGH integrity/availability impact, C...

CVE-2026-76353 Path Traversal through Knowledge Bundle Replication in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

CVE-2026-76353

CVE-2026-76353 is a path traversal vulnerability in Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The root cause is that knowledge bundle delta processing does not restrict removal paths to the staging directory, and the endpoint does not enforce the expected authorization...

CVE-2026-76344 Path Traversal through the Search Dispatch REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

CVE-2026-76344

Splunk Enterprise fails to validate search identifiers supplied to the Search Dispatch REST API, letting any non-admin user write dispatch metadata to arbitrary host paths. CVSS 3.1 base score 7.7 (HIGH), network attack vector, low privileges required. Affected branches: 9.4.x, 10.0.x, 10.2.x, 10...

EUVD-2026-63102

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

GHSA-68MJ-5WR7-6FGG vulnerabilities

Vulnerabilities for packages: conductor-fips, logstash, traccar-fips, nuxeo, zipkin, cassandra-reaper, logstash-fips, traccar, druid, thingsboard, conductor...

logto-tunnel serves files outside --experience-path via path traversal

Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...

CVE-2026-63188

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-75593

Prior to BuildKit 0.31.2, a client with control API access can craft an upload request causing files to escape the BuildKit state directory, enabling directory traversal. Fixed in v0.31.2. No exploitation details provided; CVSS 7.2 HIGH (network, low complexity, low privileges required).

CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...