47804 matches found
CentOS 9 : python3.9-3.9.25-10.el9
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.25-10.el9 build changelog. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...
PT-2026-78366
Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An unauthenticated arbitrary file upload issue exists in the image element. The system accepts arbitrary files as long as the client-supplied Content-Type falls within the image MIME group Multipurpose...
PT-2026-78771
šØ CVE-2026-76344 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer RE...
PT-2026-78646
Name of the Vulnerable Software and Affected Versions Logto Tunnel versions prior to 0.3.9 Description The Logto Tunnel npm package contains a flaw where the createStaticFileProxy function in packages/tunnel/src/commands/tunnel/index.ts processes static asset requests using path.joinstaticPath,...
Linux Distros Unpatched Vulnerability : CVE-2026-17106
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...
PT-2026-78780
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can delete arbitrary...
PT-2026-78744
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can move files readable...
PT-2026-78442
Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to...
CVE-2026-73974
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...
CVE-2026-52875
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...
CVE-2026-52872
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...
CVE-2026-50186
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
CVE-2026-48796
CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...
CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
CVE-2026-50186
An authenticated project manager in 4gaBoards
CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
EUVD-2026-62202
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...
CVE-2026-52875 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...
EUVD-2026-62199
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...