GitPython Diffable.diff File Write

The vulnerability of the Diffable.diff method in the Python library for interacting with git repositories in GitPython relates to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to re-write any files in the system remotely...

CVE-2026-75855: Improper Limitation of a Pathname to a Restricted Directory

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

flyto-core 2.26.7 - Arbitrary File Write

Exploit Title: flyto-core 2.26.7 - Arbitrary File Write Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link: https://github.com/flytohub/flyto-core Version: flyto-core = 2.26.7 fixed 2.26.8; incomplete fix of GHSA-29...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

Security Bulletin: Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Summary Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is...

CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-19589

Packer's plugin installer failed to constrain extraction paths (CWE-22), allowing a crafted archive to write files outside the plugin directory and achieve code execution. Affected versions: 1.7.0–1.15.4. Fixed in 1.16.0. Exploitation details are not provided in the documents. Users should upgrad...

CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Summary Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is...

CVE-2026-63667

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

MINI-QRR8-GMCF-WPV6

Bulletin has no description...

CVE-2026-12553

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-12553

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553

HP Web Jetadmin (WJA) is vulnerable to DLL hijacking, allowing unauthenticated remote attackers to read or write arbitrary files. CVSS 4.0 scores this CRITICAL (9.3) with network access, low complexity, and no privileges required. Exploitation is rated PROOF-OF-CONCEPT. Details: https://support.h...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

EUVD-2026-60324

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-46345

The vulnerable code output_file = trestle_root / r_output_file in trestle/core/commands/author/jinja.py accepts unvalidated -o/--output paths, enabling ../, ..\, or absolute path traversal. Exploitation is trivial (single command, no auth) and can overwrite .github/workflows/*.yml, .git/hooks/*, ...