110539 matches found
EUVD-2026-69612
Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory...
NPM: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory
NPM: Hono: Incomplete fix for CVE-2026-39408: toSSG still writes files outside the output directory vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
GHSA-C7R6-VX3H-W5G2 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
Summary Excel::store resolved the destination path against the process working directory rather than the configured filesystem disk. When that path resolved to an existing file, the export was written straight to it with fopen, bypassing the disk entirely. An application that passes a...
EUVD-2026-74191
Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'. Fixed in 4.0.80...
CVE-2026-85982 Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...
EUVD-2026-65223
GitPython: clonefrom/clone omit --separate-git-dir from unsafegitcloneoptions, enabling arbitrary git-directory creation outside the destination...
GHSA-8MCC-HRX5-HVXC GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination
CWE: CWE-73 External Control of File Name or Path / CWE-22 Path Traversal, in the "escapes intended base directory" sense - Affected component: git/repo/base.py, Repo.unsafegitcloneoptions class attribute, lines 153-165 and Repo.clone lines 1477-1520, reached via the public Repo.clonefrom line...
CVE-2026-69809
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network...
CVE-2026-69546
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-69524
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network...
CVE-2026-69359
Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally...
CVE-2026-62813
Use after free in Active Directory Domain Services allows an authorized attacker to execute code over a network...
CVE-2026-62801
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-62762
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
EUVD-2026-74034
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...
EUVD-2026-73609
Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over a network...
CVE-2026-69809
CVE-2026-69809 is a memory leak (missing release of memory after effective lifetime) in Windows Active Directory Domain Services that allows an unauthorized, unauthenticated attacker to trigger a denial of service over the network. The CVSS 3.1 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/...
CVE-2026-69546
CVE-2026-69546 is a use-after-free vulnerability in Windows Active Directory Domain Services that allows an unauthorized attacker to achieve remote code execution over the network. The CVSS 3.1 score is 8.1 (High) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high attack comple...