CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

EUVD-2026-97000

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839 thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839 thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839

The software thClaws (versions through 0.141.0 ) is vulnerable to a link-following vulnerability (CWE-59) within the post_inputs handler of the v1 API POST /v1/inputs endpoint. An attacker can plant a symlink under the permitted inputs/ prefix, which allows subsequent authenticated uploads to wri...

CVE-2026-108839 thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

PT-2026-110168

Name of the Vulnerable Software and Affected Versions thClaws versions prior to 0.141.0 Description A link-following issue exists in the post inputs handler of the 'POST /v1/inputs' API endpoint. This flaw allows writes outside the designated workspace by following symbolic links symlinks, which...

CVE-2026-108839: Improper Link Resolution Before File Access

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-87114 Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator'...

CVE-2026-87114: Inclusion of Functionality from Untrusted Control Sphere

A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbitrary code execution on the operator'...

perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file()

A flaw was found in HTTP::Daemon, a Perl module used for creating HTTP servers. A remote attacker can exploit this vulnerability by providing specially crafted input to the sendfile function, leading to OS command injection. This allows the attacker to execute arbitrary commands on the system wit...

CVE-2026-41567

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

UBUNTU-CVE-2026-41567

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

CVE-2026-41567: Uncontrolled Search Path Element

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via PUT /containers/id/archive or piped through docker cp -, the daemon resolves decompression binaries such as xz or unpigz fr...

Moby Moby/v2/daemon: Vulnerabilities related to permission granting and access control

Moby is an open-source project developed by Moby. It aims to promote the containerization of software and help the ecosystem make container technology mainstream. Versions of Moby prior to v2.0.0-beta.14 contained code-related vulnerabilities. These vulnerabilities stemmed from incorrect order of...

Exploit for CVE-2026-2249

Overview The METIS DFS devices, specifically in versions lowe...

CVE-2026-2249

METIS DFS devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the...

CVE-2026-2249

METIS DFS devices expose an unauthenticated web-based shell at /console, allowing remote command execution with daemon privileges on affected versions (

CVE-2026-2249

METIS DFS devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' privileges. This results in the compromise of the...