CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

CVE-2026-86542 knowns before 0.30.0 Path Traversal via Import Name

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-86541

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() MCP handler function. Attackers can supply absolute paths or relative paths with directory traversal sequences to overwrite arbitrary files outside the project root, potentially writing malicious conte...

CVE-2026-86541 knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

USN-8733-1: Gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

USN-8733-1 gzip vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that Gzip's gzexe utility created temporary files in an insecure manner when mktemp was unavailable. A local attacker could possibly use this issue to overwrite arbitrary files. CVE-2026-41991 Elias Hasas, Michał Majchrowicz and Marcin...

Relative Path Traversal

Overview org.apache.ant:ant is a software tool for automating software build processes which originated from the Apache Tomcat project in early 2000. Affected versions of this package are vulnerable to Relative Path Traversal through the file retrieval logic in FTPTask, FTPTaskMirrorImpl,...

CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

AZL-99972 CVE-2026-78254 affecting package ant for versions less than 1.10.18-1

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

CVE-2026-78254

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

CVE-2026-78254

Apache Ant versions prior to 1.10.18 are vulnerable to a path traversal flaw in the ftp and scp tasks. A malicious server, or an attacker performing a machine-in-the-middle attack, can provide relative paths that allow the application to write files outside the designated target directory. This e...

PT-2026-86934

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

PT-2026-86935

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the...

CVE-2026-78254: Relative Path Traversal

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

CVE-2026-78254: Relative Path Traversal

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

Linux Distros Unpatched Vulnerability : CVE-2026-78254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the...

CVE-2026-86439: Improper Limitation of a Pathname to a Restricted Directory

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86541: Improper Limitation of a Pathname to a Restricted Directory

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

CVE-2026-67279 SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated...