32936 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-104824)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104824 advisory. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is used with an attacker-controlled server. Tenable...
CVE-2026-75413: Files or Directories Accessible to External Parties
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-80191: Missing Authorization
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...
CVE-2026-61792: Improper Limitation of a Pathname to a Restricted Directory
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75332
Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...
CVE-2026-80191
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...
CVE-2026-79792 zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...
CVE-2026-79792
zackees transcribe-anything up to version 4.1.0 is affected by an OS command injection in the ytdlp_download function within src/transcribe_anything/ytldp_download.py (component: Yt-dlp Download). The flaw is triggered by manipulating the url argument, allowing a remote attacker to execute arbitr...
CVE-2026-79792
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...
GO-2026-6289 Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve...
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths vulnerability discovered by ? in WordPress Npm browse-mcp versions = 0.8.1...
browse-mcp has an arbitrary file write via unconfined download and state paths
Impact browserdownload wrote a fetched file to joinsavedir, filename with no validation of savedir, and browsersavestate / browserloadstate honored an explicit path unchanged. The MCP caller controls these arguments a malicious MCP client, or an autonomous agent steered by indirect prompt injecti...
CVE-2026-79785 X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads
X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...
CVE-2026-79785
X-AnyLabeling's model downloader disabled TLS certificate verification by calling ssl._create_unverified_context() in download_with_retry (within anylabeling/services/auto_labeling/model.py), so neither the certificate chain nor hostname was validated when fetching models over HTTPS. An attacker ...
CVE-2026-70551
CVE-2026-70551 is a Server-Side Request Forgery (SSRF) vulnerability in JFrog Artifactory via VCS remote download. A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL , redirecting the server's request to an attacker-controlle...
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...
CVE-2026-70551 Server-Side Request Forgery Via VCS remote download in JFrog Artifactory
A user who can read an existing remote VCS repository can replace its configured origin or supply an absolute VCS data URL...
GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...
