CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

AZL-105645 CVE-2026-102991 affecting package python-mako 1.2.4-3

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102127

The Kiteworks Email Protection Gateway is vulnerable to an XML External Entity (XXE) injection due to an XML parser that does not restrict external entity references. If an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could submit a crafted mess...

CVE-2026-102127 Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message-processing feature is enabled, a remote and unauthenticated sender could potentially use a crafted message to read files accessible to the gateway service...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991 Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.gettemplate in mako/lookup.py resolves template URIs with posixpath, while Template.init in mako/template.py validates them with os.path, which uses ntpath. A URI beginning with a drive designator causes ntpa...

CVE-2026-102991

The Mako Python template library is vulnerable to a path traversal flaw on Windows in versions prior to 1.4.2 . The issue stems from a discrepancy where TemplateLookup.get_template() uses posixpath to resolve URIs, while Template.__init__() uses os.path (which utilizes ntpath) for validation. Att...

CVE-2026-10726

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

EUVD-2026-89780

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726

The Cato Windows SDP Client before version 6.12.6 is vulnerable to an arbitrary file disclosure vulnerability. A low-privileged local user can exploit this flaw to force the Windows service—which operates with Local System privileges—to read and disclose arbitrary local files. The root cause is a...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

Tika-CVE-2025-66516-Lab

CVE-2025-66516 Entorno de validación minimalista Este proyecto se utiliza para validar CVE-2025-66516 vulnerabilidad de inyección de entidades externas XML en Apache Tika. Resumen de la vulnerabilidad Apache Tika 3.2.1 y versiones anteriores no deshabilitan correctamente la carga de entidades...

CVE-2021-41773-L-

CVE-2021-41773 🐛 Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 Se encontró una falla en un cambio realizado a la normalización de rutas en Apache HTTP Server 2.4.49. Un atacante podría usar un ataque de path traversal para asignar URLs a archivos fuera de...

cve-2021-29447_auto-script

CVE-2021-29447: WordPress Media Library XXE Vulnerability This repository details the CVE-2021-29447 vulnerability, a critical security flaw in WordPress that allowed for authenticated XML External Entity XXE attacks through the Media Library. It also provides an automatic script that demonstrate...

proftpd-mod_copy-cve-2015-3306

Vulnerabilidad modcopy en ProFTPD 1.3.5 CVE-2015-3306 Este repositorio contiene el informe de laboratorio para explotar un servicio vulnerable ProFTPD 1.3.5 en la plataforma Hackviser. El laboratorio demuestra el acceso no autorizado a un archivo sensible secret.txt utilizando la vulnerabilidad...

AlmaLinux 9.2 [TuxCare] Security Update: inkscape / inkscape-docs / inkscape-view (ALMALINUX9.2:CLSA-2026:1788452050)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788452050 advisory. - A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote attacker to read loca...

AlmaLinux 9.2 [TuxCare] Security Update: assertj-core / assertj-core-javadoc (ALMALINUX9.2:CLSA-2026:1788881384)

"The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788881384 advisory. - AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine JVM. Starting in version 1.4.0 and prior to version 3.27....