CVE-2026-114094 Dulwich before 1.2.9 Arbitrary File Write via DOS drive letter paths

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094

Versions of Dulwich before 1.2.9 are vulnerable to an arbitrary file write on Windows due to a failure to validate DOS drive letter prefixes in Git tree path elements. An attacker can craft a malicious repository containing a tree entry named 'C:' , which bypasses NTFS validation . This allows th...

EUVD-2026-106897

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114094

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a malicious repository with a tree entry named 'C:' that bypasses NTFS validation and writes files outside the worktree to achieve remote code...

CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

EUVD-2026-107014

SvelteKit @sveltejs/kit from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunne...

CVE-2026-114063

SvelteKit (@sveltejs/kit) versions 2.10.0 before 3.0.0 are vulnerable to a path traversal vulnerability within the vite preview server on Windows systems. This flaw allows unauthenticated attackers with network access or a tunnel to the preview server to send crafted requests and read files outsi...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

EUVD-2025-211142

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437 Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim...

CVE-2025-71437

The Astral uv package version 0.8.21 and earlier is vulnerable to a path traversal vulnerability during the extraction of source distribution (sdist) tar files. The root cause is a flaw where a specially crafted sequence of symlinks can be used to redirect file writes outside of the intended extr...

EUVD-2026-106862

IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type...

EUVD-2026-105901

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

EUVD-2026-105894

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

EUVD-2026-105893

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

EUVD-2025-211139

A segmentation violation in the gfpropsequalinternal function /filtercore/filterprops.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted data file...