CVE-2026-65164

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

EUVD-2026-98559

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-65164

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-65164

NVIDIA AIStore for Linux is vulnerable to a path traversal vulnerability within its dSort archive extraction component . A remote attacker can exploit this by supplying crafted archive member names to a dSort job, leading to an improper limitation of a pathname to a restricted directory. Conseque...

CVE-2026-65164

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-65164: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-106108: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

PT-2026-111518

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-54459

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-54459

The web-based file manager FileRise is vulnerable to Cross-Site Request Forgery (CSRF) in versions prior to 3.14.0 . The application fails to enforce the X-CSRF-Token header for the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php. This allows an attacker to potentially f...

CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing...

CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-104102: Improper Limitation of a Pathname to a Restricted Directory

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-108600

open-multi-agent @open-multi-agent/core 1.5.0 through 1.21.2 contains a link following vulnerability in the filewrite tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the age...

CVE-2026-101024 Satel Netco Design Relative path traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitati...

CVE-2026-101024

Satel Netco Design versions prior to v2.1.7 are vulnerable to a relative path traversal vulnerability within the data export functionality . An authenticated user with Viewer privileges can exploit this flaw to write attacker-influenced content to file system locations accessible to the applicati...

CVE-2026-107377

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

CVE-2026-101024: Relative Path Traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitati...