13256 matches found
CVE-2026-72585
Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...
CVE-2026-72567
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
CVE-2026-72569
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
CVE-2026-72585
Summary: CVE-2026-72585 affects Grafana up to version 13.2.0. An Editor-role user can delete protected contact points (receivers) because the DELETE path in receiver services was not updated with the protected-field check, even though CVE-2026-21724’s fix addressed only the UPDATE code path in th...
CVE-2026-72585
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
EUVD-2026-55221
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points receivers without the required alert.notifications.receivers.protected:write permission...
CVE-2026-72569
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
EUVD-2026-55237
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
CVE-2026-72569 cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
CVE-2026-72569
The CVE-2026-72569 entry describes a path traversal vulnerability in cube-root/directory-serve
CVE-2026-72567
The CVE-2026-72567 entry concerns AsyncFuncAI/deepwiki-open. A path traversal flaw arises from improper validation in the wiki-cache API endpoint (api/api.py) which builds file paths from user-controlled owner, repo, and repo_type fields, allowing unauthenticated remote actors to write to or dele...
CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
CVE-2026-64564
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF Add IP Address Configuration chunks, including DEL-IP Delete IP Address parameters, to trigger a use-after-free condition...
CVE-2026-21059
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...
CVE-2026-21058
Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...
CVE-2026-21059
Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege...
CVE-2026-21059
Samsung Contacts (prior to SMR Aug-2026 Release 1) improperly exports Android application components, allowing local attackers with low privileges to delete files under the app's elevated privileges. CISA SSVC marks exploitation as "none"; no exploit code is known. Apply the SMR Aug-2026 Release ...