CVE-2026-32684

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information...

SUSE-SU-2026:21635-1 Security update for helm

This update for helm fixes the following issues Security issues: - CVE-2025-55199: crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart bsc1261938. Non security...

Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate

None...

MAL-2026-3681 Malicious code in @catamania/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 326cc4cf1fbe96c77b6340df59ebea040cdd522e3e4bc76471563190044cf53a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" in package.json that runs automatically during npm install...

Malicious code in @chahuadev/junk-sweeper-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51 The package's postinstall script package.json line 10: "postinstall": "node install.js" unconditionally fetches a platform-native executable from...

CVE-2026-29203

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path...

EUVD-2026-29325

barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4common.c where the ext4fsiteratedir function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a...

Hikvision Hik-Connect APP 安全漏洞

Hikvision Hik-Connect APP is a mobile monitoring application developed by Hikvision, a company in China, designed for remote access and management of video surveillance devices. The Hikvision Hik-Connect APP has a security vulnerability, which stems from insufficiently strict restrictions on...

PT-2026-40359

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip. The function GetAllPaths recurses into subdirectories without any depth limit or visited-inode tracking. A crafted UFS...

PT-2026-40119

The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e 2025-30-21 contains an insecure deserialization vulnerability CWE-502 in its model loading process. When loading model files .pt from a user-specified directory via the --model dir argument, the code uses torch.load withou...

Langflow 路径遍历漏洞

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Versions of Langflow prior to 1.9.0 contained a path traversal vulnerability. This vulnerability stemmed from the path traversal in the knowledge base API, which could allow...

PT-2026-40040

Name of the Vulnerable Software and Affected Versions Ivanti Xtraction versions prior to 2026.2 Description External control of a file name allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory. This can lead to information disclosure and...

PT-2026-40158

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally...

PT-2026-40449

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.21 Description Authenticated users can write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. This occurs due to an unvalidated filename parameter in the uplo...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability. This vulnerability arises from the use of a security filter for variable expansion, where all subsequent pipes on the same strin...

Microsoft Lightweight Directory Access Protocol（LDAP） 代码问题漏洞

Microsoft Lightweight Directory Access Protocol LDAP is a directory service protocol developed by Microsoft Corporation. It operates at the layer above the TCP/IP stack. There are code-related vulnerabilities in the Microsoft Lightweight Directory Access Protocol LDAP. Attackers can exploit these...

PT-2026-40019

Name of the Vulnerable Software and Affected Versions Multiple Products affected versions not specified Description A path traversal issue occurs when user-supplied input is improperly handled during server-side file path processing. This can lead to unauthorized access to sensitive files by...

CVE-2026-31217

The CVE-2026-31217 entry concerns the optimate project’s neural_magic_training.py _load_model() function. If a user supplies a directory via --model, it reads module.py from that directory and executes its contents with Python's exec() without validation or sanitization. This enables an attacker ...

CVE-2026-31217

The loadmodel function in the neuralmagictraining.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f 2024-07-21 allows arbitrary code execution. When a user supplies a directory path via the --model command-line argument, the function reads a module.py file from...

PT-2026-40423

Name of the Vulnerable Software and Affected Versions Pulpy versions prior to 0.1.1 Description Pulpy injects a pulpy.fs JavaScript API into packaged web applications to provide host filesystem access. The validateFsPath function, intended to sandbox this access, contains an incomplete blocklist...