Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

Eclipse OpenJ9 input validation error vulnerability

Eclipse OpenJ9 versions 0.63 and earlier contain a security vulnerability. This vulnerability arises when the jdmpview tool or equivalent DTFJ code is used to open a specially crafted diagnostic dump package; it may then read any local file specified within the package and send its contents to an...

Advantech Adam-3600 path traversal vulnerability

The Advantech Adam-3600 versions prior to 2.8.5.0 have a path traversal vulnerability. This vulnerability allows for attacks where path traversal is possible, potentially enabling authenticated attackers to access any file on the system...

DrayTek Vigor2960 path traversal vulnerability

DrayTek Vigor2960 1.5.1.6 Revision 8218 has a path traversal vulnerability. This vulnerability stems from incorrect handling of the setSWMProfile parameter in the function setSWMProfile located in the file/cgi-bin/mainfunction.cgi. This could lead to path traversal attacks, and attackers could...

Aspose PDF Exporter path traversal vulnerability

Versions of Aspose PDF Exporter 2.0 prior to version 2.0 have a path traversal vulnerability. This vulnerability stems from the use of the file parameter, which is not properly cleaned up when passed to the readfile function. This allows for path traversal attacks; unauthenticated attackers can...

Stormshield Network Security Authorization Issue Vulnerability

Stormshield Network Security versions 4.3.0 to 4.3.44, 4.8.0 to 4.8.19, 5.0.0 to 5.0.9, and 5.1.0 to 5.1.3 have an authorization issue vulnerability. This vulnerability arises from a failure in the dynamic data file signature check; there are logical errors in the signature verification routine,...

tox-dev filelock backend link vulnerability

In versions of tox-dev FileLock from 4.0.0 to 4.2.1, there was a post-processing link vulnerability. This vulnerability stemmed from SoftReadWriteLock’s mechanism for refreshing holder records by name. Local users with permission to rename lock directories could replace the records with named...

TYPO3 FAL Protect authorization issue vulnerability

The TYPO3 FAL Protect version 1.7.1 up to 1.8.2 had an authorization issue vulnerability. This vulnerability stemmed from extensions not applying access protection to files stored in file storage that used non-default relative base paths. As a result, these files were directly provided by the web...

Oracle Autonomous Health Framework security vulnerabilities

The Oracle Autonomous Health Framework versions 26.3 to 26.8 have security vulnerabilities. These vulnerabilities stem from issues with the Trace File Analyzer component. They could allow low-privilege attackers to log in to the infrastructure that runs Oracle Autonomous Health Framework and take...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053

The open source billing platform FOSSBilling is vulnerable to a path traversal flaw in versions 0.1.0 through 0.8.7. The api/guest/system/template_exists endpoint improperly handles the file parameter by using Path::join without filtering .. sequences or validating the resolved path against the a...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111045

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

EUVD-2026-104412

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

MAL-2026-17954 Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff887d27322671592352c1e6755c4c39bc7be6f1bbb2148dc69ce2d3018a63e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18024 Malicious code in mp3-do-wnload-file-to-day-d-nu951-cjkdsy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26a72bd5e4d4d678ec021807c8590abdecbe43a46702c59d46d8282298556226 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17953 Malicious code in a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fea9dc3511b8a42a624a4257e69fc68933bef239240dc0af0d030f3dc72421b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in a-vailable-al-bum-file-101379-communion-mt1lk-dvshll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db1398121380a70266af797842060413f11382cdcae697045a6510b6e393c2e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...