2934 matches found
Buffalo WSR-2533DHPL2 - Path Traversal
Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. id: CVE-2021-20090 info: name: Buffalo WSR-2533DHPL2 - Path...
CVE-2026-53453
Blueprint Studio (a Home Assistant config editor) failed to enforce its admin-only authorization boundary prior to v2.5.2, allowing any authenticated non-admin user to invoke arbitrary services, modify config files, expose state, upload files, and reach terminal helpers, compromising CIA of the i...
CVE-2026-57469
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
ALPINE-CVE-2026-53802
rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...
CVE-2026-9077
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...
CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks
pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...
CVE-2026-14818
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...
CVE-2026-17614
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
CVE-2026-14818
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...
CVE-2026-17614
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
CVE-2026-17614 Wildfly-core: path traversal on wildfly domain controller
A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile and getConfigurationFile methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A...
PT-2026-67635
A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...
CVE-2026-56567
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
CVE-2026-56569
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...
CVE-2026-52857
CVE-2026-52857 affects Wings (Pterodactyl server control plane). Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings’ memory. This is fixed in version 1.13.0. Impact is Availability (O...
CVE-2026-56569
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
CVE-2026-56569
Technical details of CVE-2026-56569 are not publicly available in the provided documents. Affected components, root cause, impact, and fixes are not disclosed here. Monitor the referenced sources for updates.
CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
