Apache Linkis security vulnerabilities

Apache Linkis is a middleware product developed by the Apache Foundation in the United States. It enables effective connections between upper-level applications and underlying data engines. Versions of Apache Linkis 1.7.0 and earlier contain security vulnerabilities. These vulnerabilities stem fr...

SiYuan path traversal vulnerability

SiYuan is a privacy-oriented personal knowledge management system developed by SiYuan. Versions of SiYuan prior to 3.5.4 contained a path traversal vulnerability. This vulnerability stemmed from the markdown feature, which allowed unlimited server-side HTML rendering, potentially leading to...

GHSA-VX9W-5CX4-9796 Crawl4AI Has Local File Inclusion in Docker API via file:// URLs

A local file inclusion vulnerability exists in the Crawl4AI Docker API. The /executejs, /screenshot, /pdf, and /html endpoints accept file:// URLs, allowing attackers to read arbitrary files from the server filesystem. Attack Vector: json POST /executejs "url": "file:///etc/passwd", "scripts":...

CVE-2026-22876

Path Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If this vulnerability is exploited, arbitrary files on the affected product may be retrieved by a logged-in user with the low"monitoring user" or higher privilege...

Qnap QTS and QuTS hero Improper Link Resolution Before File Access (CVE-2024-53691)

A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the vulnerability in the following...

Code-Projects Police Station Management System Security Vulnerabilities

Code-Projects Police Station Management System is an open-source police station management system developed by Code-Projects. The Code-Projects Police Station Management System has a security vulnerability that can be exploited by absolute path traversal attacks, potentially leading to arbitrary...

MiracleLinux 7 : samba-4.2.3-11.el7 (AXSA:2016-023:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-023:01 advisory. Samba is the standard Windows interoperability suite of programs for Linux and Unix. Security issues fixed with this release: CVE-2015-3223 The...

Arcane Has a Command Injection in Arcane Updater Lifecycle Labels That Enables RCE

Summary Arcane’s updater service supported lifecycle labels com.getarcaneapp.arcane.lifecycle.pre-update and com.getarcaneapp.arcane.lifecycle.post-update that allowed defining a command to run before or after a container update. The label value is passed directly to /bin/sh -c without sanitizati...

EUVD-2026-2714

Entrust Instant Financial Issuance IFI On Premise software formerly referred to as CardWizard versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an insecure .NET Remoting exposure in the SmartCardController service DCG.SmartCardControllerService.exe. The service registers a TCP remoting...

SICK TDC-X401GL has security vulnerabilities

The SICK TDC-X401GL is a edge computing gateway developed by the German company SICK. The SICK TDC-X401GL has a security vulnerability. This vulnerability allows attackers to access the host file system without authorization, potentially leading to the reading and modification of system data...

CVE-2026-20941

Improper link resolution before file access 'link following' in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally...

Vulnerabilities fixed in Adobe Dreamweaver Desktop

Adobe has fixed vulnerabilities in Dreamweaver Desktop Versions 21.6 and earlier. The vulnerabilities are in the way Dreamweaver Desktop validates input. This can lead to unauthorized file manipulation and execution of arbitrary code. Exploitation of these vulnerabilities requires user interactio...

Arbitrary File Access

Werkzeug is vulnerable to Arbitrary File Access. The vulnerability is due to insufficient validation in the safejoin function on Windows, where path segments using reserved device names such as CON or AUX with extensions or trailing spaces are allowed, enabling attackers to access special device...

MiracleLinux 3 : xen-3.0.3-64.3.1AXS3 (AXSA:2008-443:02)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2008-443:02 advisory. This package contains the Xen tools and management daemons needed to run virtual machines. Information on how to use Xen can be found at the Xen...

MiracleLinux 4 : krb5-appl-1.0.1-2.AXS4.1 (AXSA:2011-703:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2011-703:01 advisory. This package contains Kerberos-aware versions of the telnet, ftp, rcp, rsh, and rlogin clients and servers. While these have been replaced by tools such as...

CVE-2022-50897

mPDF 7.0 contains a local file inclusion vulnerability that allows attackers to read arbitrary system files by manipulating annotation file parameters. Attackers can generate URL-encoded or base64 payloads to include local files through crafted annotation content with file path specifications...

Directory Traversal

Overview jaraco.context is an Useful decorators and context managers Affected versions of this package are vulnerable to Directory Traversal via the stripfirstcomponent function. An attacker can access or create arbitrary files outside the intended extraction directory by supplying a crafted tar...

CVE-2026-20941

CVE-2026-20941 describes an elevation-of-privilege in the Windows Host Process for Windows Tasks caused by improper link resolution before file access (link following). The issue is local and affects Windows client/server platforms as scoped by the January 2026 updates. Microsoft lists fixes in K...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid removing buffers when legacy fileio is active The vb2ioctlremovebufs call manipulates the internal buffer list of the queue. This may potentially overwrite pointers used by the legacy fileio interface...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: ceph: fixed the issue where multifs mds auth caps was applied incorrectly The mds auth caps check should also validate the fsname along with the associated caps. Failure to do so would result in applying the mds auth caps of o...