GHSA-469J-VMHF-R6V7 NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite

Vulnerability Description The NLTK downloader does not validate the subdir and id attributes when processing remote XML index files. Attackers can control a remote XML index server to provide malicious values containing path traversal sequences such as ../, which can lead to: 1. Arbitrary Directo...

PT-2026-26300

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior Description NLTK Natural Language Toolkit is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. The NLTK downloader does not validat...

Jenkins has a link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...

GHSA-R6QV-FRPC-Q66C Jenkins has a link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...

Link following vulnerability allows arbitrary file creation

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives. This allows crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running...

EUVD-2026-12522

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

DEBIAN-CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names...

CVE-2026-21991

The CVE-2026-21991 issue affects the DTrace component dtprobed, specifically its handling of USDT probes, enabling arbitrary file creation through crafted provider names. Multiple connected advisories confirm dtprobed as the vulnerable element and describe the risk of code execution as a worst-ca...

CVE-2026-21001

Path traversal in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

CVE-2026-21000

The connected EUVD-2026-12317 entry describes an improper access control in Galaxy Store prior to version 4.6.03.8, allowing a local attacker to create a file with Galaxy Store privileges. Affected product: Galaxy Store; affected versions: before 4.6.03.8. Root cause: improper access control. Imp...

CVE-2026-21000

Improper access control in Galaxy Store prior to version 4.6.03.8 allows local attacker to create file with Galaxy Store privilege...

Oracle Linux 安全漏洞

Oracle Linux is an open and complete operating environment provided by Oracle Corporation in the United States. It offers virtualization, management, and cloud-native computing tools, as well as an operating system. There is a security vulnerability in Oracle Linux, which can be exploited through...

PT-2026-25827

Name of the Vulnerable Software and Affected Versions DTrace affected versions not specified Description The DTrace component, dtprobed, is subject to an issue that permits arbitrary file creation via specially crafted USDT provider names. The issue involves the use of crafted names to trigger th...

PT-2026-25606

Name of the Vulnerable Software and Affected Versions Galaxy Store versions prior to 4.6.03.8 Description A path traversal issue exists in Galaxy Store versions prior to 4.6.03.8. This allows a local attacker to create a file with Galaxy Store privileges. Recommendations Update Galaxy Store to...

SAMSUNG Galaxy Store 安全漏洞

SAMSUNG Galaxy Store is an application store owned by South Korean company Samsung. Versions of SAMSUNG Galaxy Store prior to version 4.6.03.8 contained security vulnerabilities. These vulnerabilities were due to improper access control, which could allow local attackers to create files with...