492291 matches found
GHSA-CW65-GX24-RC82 virtualenv: Builtin creation follows linked environment directories
Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15...
CVE-2026-114140
A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-controlled cell output metadata can traverse outside the targ...
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
DEBIAN-CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-109741
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: Bucket File System component...
External Control of File Name or Path
Overview pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the SVG rendering path in src/Renderer.js, where local images embedded within SVG content bypass the setLocalAccessPolicy...
libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
CLSA-2026-1792612283 libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
CLSA-2025-1761139764 kernel: Fix of 39 CVEs
nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
EUVD-2026-107558
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379
A file inclusion vulnerability exists in EKKOLearnAI ekko-studio versions up to 1.0.6 . The flaw is located in the Media Generation API component, specifically within the saveGeneratedImages function of the file packages/server/src/modules/studio/controllers/media.ts. An attacker can manipulate t...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
EUVD-2026-104646
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...