13718 matches found
EEF-CVE-2026-32685 Path Traversal in gleam docs build via documentation.pages Allows Arbitrary File Read and Write
Summary Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory. The documentation.pages entries from gleam.toml are incorporated into filesystem paths without sufficient validatio...
CVE-2026-43965 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::readfromdisc are passed without validation to paths.buildpackagespackage, whi...
PT-2026-45757
Name of the Vulnerable Software and Affected Versions Gleam versions 0.18.0-rc1 through 1.17.0 Description A path traversal issue in the dependency management system allows for the recursive deletion of arbitrary directories. This occurs because package keys read from the...
CVE-2026-43965: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::readfromdisc are passed without validation to paths.buildpackagespackage, whi...
PT-2026-45750
Name of the Vulnerable Software and Affected Versions Gleam versions 1.16.0 through 1.17.0 Description A path traversal issue exists in the handling of custom documentation pages. The documentation.pages entries within the gleam.toml file are incorporated into filesystem paths without sufficient...
Malicious Package
Overview app-config-utility is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...
CVE-2026-49135
CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read...
animo-trainer (1.0.2), build-harness (1.0.1) +16 more potentially affected by CVE-2026-8643 via pip (22.0.4)
pip PYPI version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - animo-trainer 1.0.2 - build-harness 1.0.1 - cacheback2 0.0.5 - cdp-connector =1.0.0, =1.26.6, =1.2.3, =2022.3.0b0, =2022.3.0b0, =0.4.0rc0, =0.6.16,...
CVE-2026-10276 hekmon8 Jenkins-server-mcp get_build_status/get_build_log/trigger_build index.ts jobPath server-side request forgery
A vulnerability has been found in hekmon8 Jenkins-server-mcp 0.1.0. This vulnerability affects the function jobPath of the file src/index.ts of the component getbuildstatus/getbuildlog/triggerbuild. Such manipulation leads to server-side request forgery. The attack may be performed from remote. T...
CVE-2026-10273
Affected software: php-censor (up to 2.1.6). The vulnerability is in the Webhook Endpoint, specifically the file src/Model/Build/GitBuild.php, where manipulating the commitId argument can lead to operating system command injection. Impact is remote: attacker can exploit over the network. The expl...
@1771technologies/oneplay (>=0.0.1, <=0.0.6), @24hr/ettapi (>=0.2.4, <=0.2.5) +96 more potentially affected by CVE-2026-47429 via vitest (>=3.0.2, <=3.2.4)
vitest NPM version =3.0.2, =0.0.1, =0.2.4, =0.5.0, =2.2.1, =2.1.0-alpha.249, =0.0.0, =4.0.0-alpha.5, =0.1.2-next.95, =1.0.0, =1.0.388, =0.0.207, =3.8.0, =4.1.6 and more Source cves: CVE-2026-47429 Source advisory: OSV:GHSA-5XRQ-8626-4RWP...
Exploit for Integer Overflow to Buffer Overflow in Perl
CVE-2026-8376-Perl-Heap-Buffer-Overflow-PoC-Exploit Perl vers...
PT-2026-45438
Name of the Vulnerable Software and Affected Versions VeronaLabs WP Statistics versions prior to 14.16.6 Description Improper neutralization of input during web page generation allows for DOM-Based Cross-Site Scripting XSS, a flaw where the application contains client-side JavaScript that process...
PT-2026-45449
A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...
CVE-2026-10273: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in php-censor up to 2.1.6. This affects an unknown function of the file src/Model/Build/GitBuild.php of the component Webhook Endpoint. Performing a manipulation of the argument commitId results in os command injection. The attack can be initiated remotely. The exploit h...
automation application Conda-build Race Situation Code Execution
The vulnerability of the automation application and the Conda-build package distribution in Python is related to errors in inherited permissions. Exploiting this vulnerability could allow a perpetrator to trigger a “race condition” and execute arbitrary code...
ManageEngine ADSelfService Plus < Build 6525 Authenticated RCE
According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6525. It is, therefore, affected by an authenticated remote code execution vulnerability. This vulnerability stems from improper access controls to the service used...
CVE-2026-5071
CVE-2026-5071 affects Zephyr RTOS SocketCAN. A NET_ASSERT-based length check in zcan_sendto_ctx() allows out-of-bounds reads in socketcan_to_can_frame() when an attacker controls the length passed to a sendto syscall and assertions are disabled in production builds. Consequences include denial-of...
NeuroLog: Reasoning You Can Audit -- Neuro-Symbolic Vulnerability Discovery Via LLM Facts, Datalog, and SMT
Vulnerability discovery on C/C++ source asks the analyst to choose between heavyweight static analysers, which need a working build before a single query runs, and free-form LLMs, which read source readily but invent details and lose track of cross-function dataflow on real codebases. We present...