CVE-2024-46987

CVE-2024-46987 — Camaleon CMS Arbitrary Path Traversal For authorised security assessments, penetration testing engagements, and educational research only. Overview Field| Detail ---|--- CVE| CVE-2024-46987 Product| Camaleon CMS Versions| = 2.8.0, 2.8.2 also confirmed on 2.9.0 Type| Path Traversa...

EulerOS 2.0 SP15 : perl-Archive-Tar (EulerOS-SA-2026-4000)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.x000D x000...

Unsafe Polymorphic Deserialization

jackson-databind is vulnerable to unsafe polymorphic deserialization. The vulnerability is due to DefaultBaseTypeLimitingValidator allowing essentially any class implementing Comparable, which allows an attacker to provide a crafted type identifier and instantiate attacker-chosen objects such as...

CVE-2026-97164

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

EUVD-2026-87931

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164

The Event Gallery extension for Joomla (developed by svenbluege.de ) versions

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

CVE-2026-97164: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...

PT-2026-99534

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description An authenticated user can perform arbitrary path deletion through the clear cache task. By manipulating the images parameter within the cache.process task, it is possible to recursively delete...

EUVD-2026-85536

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71462

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

CVE-2026-71462: Observable Response Discrepancy

StringListPathField.tointernalvalue calls os.path.exists on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRETKEY, k8s service-account token, receptor sockets, ConfigMap mount...

PT-2026-95010

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains a flaw where the do actual install function in libmport/bundle read install pkg.c utilizes path-based lstat, chown, stat, and chmod operations during package...

CVE-2026-85668: External Control of File Name or Path

Xinference affected commit 4a94832, v3.x contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint, which accepts a caller-supplied modelpath parameter without authentication or path confinement. The endpoint reads and parses config.json,...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: umoci (UTSA-2026-031608)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031608 advisory. Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when umoci unpack o...

CVE-2026-19755

NoSleep 1.5.1 (a macOS application) exposes a privileged XPC Mach service that accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values. This allows an attacker with local access and low privileges to achieve unauthorized disclosure of root-owned files throug...

CVE-2026-77176

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

CVE-2026-75627

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager...