two-dots-and-a-slash-cve-2026-18907-tecno-hi-browser-download-path-traversal

CVE-2026-18907 — Path Traversal in TECNO Hi Browser Download Handler Proof-of-concept for CVE-2026-18907 CVSS 7.5 High, CWE-23, a relative path-traversal vulnerability in the download file feature of TECNO Hi Browser com.talpa.hibrowser version 2.23.1.1. The browser trusted an attacker-controlled...

CVE-2026-109155

A path traversal vulnerability exists in DeepPavlov versions up to 1.7.0 . The flaw resides in the untar function within the Model Download Handler component. This vulnerability allows for remote execution of a path traversal attack. While the issue was reported via a project issue report, the pr...

CVE-2026-109155 DeepPavlov Model Download untar path traversal

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-108683

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2026-108683 zhayujie CowAgent Media Download memory allocation

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2026-108683

A security vulnerability exists in zhayujie CowAgent versions up to 2.1.9 . The flaw is located within an unknown function of the Media Download Handler component, where manipulation can lead to uncontrolled memory allocation . This issue can be exploited remotely, and the exploit has been disclo...

EUVD-2026-97039

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2026-108683 zhayujie CowAgent Media Download memory allocation

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

CVE-2026-108683: Memory Allocation with Excessive Size Value

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed...

PT-2026-110186

Name of the Vulnerable Software and Affected Versions zhayujie CowAgent versions prior to 2.2.0 Description A remote attack can be launched against the Media Download Handler component. An unknown function within this component allows for uncontrolled memory allocation, which occurs when the syst...

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

EUVD-2026-91395

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472

YesWiki versions prior to 4.6.7 are affected by a missing authorization vulnerability in the attachment download handler . This flaw allows unauthenticated attackers to bypass page read Access Control Lists (ACLs). By requesting the download handler with a known page tag and file parameter , an a...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104472: Missing Authorization

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

PT-2026-104282

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...