13965 matches found
PT-2026-82817
Name of the Vulnerable Software and Affected Versions Suricata-Update affected versions not specified Description Suricata-Update fails to properly validate destination paths during the extraction of files from downloaded rule archives. This flaw allows an attacker to write arbitrary files outsid...
HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write
HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism. Update your WJA Software to the latest version...
CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74796
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...
EUVD-2026-59918
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...
EUVD-2026-59792
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-74796: Improper Link Resolution Before File Access
OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...
CVE-2026-74764
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora
Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...
CVE-2026-74764
CVE-2026-74764 affects Pandora’s TAR extraction. The extractor passes archive member names directly to Python tarfile.TarFile.extract() without a filter, enabling path traversal via ../ or absolute paths. This could allow overwriting files in the Pandora worker directory and potentially lead to a...
CVE-2026-64607 vulnerabilities
Vulnerabilities for packages: logstash, wavefront-proxy, nrjmx, sonarqube, akhq, druid, opensearch, flyway, thingsboard, dependency-track, trino, apicurio-registry, cloudwatch-exporter, zipkin, kserve-modelmesh, cassandra-reaper...
CVE-2026-74487 binfmt_misc: restore write access when removing an entry
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...
CVE-2026-74486 binfmt_misc: use exe_file_deny_write_access() for the interpreter clone
In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: use exefiledenywriteaccess for the interpreter clone For MISCFMTOPENFILE entries loadmiscbinary clones the registered interpreter file and denies write access to the clone via plain denywriteaccess. The clone is...
PT-2026-73060
Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Pandora contains a path traversal issue in its TAR archive extraction functionality. The extractor passes archive member names directly to the tarfile.TarFile.extract function without applyin...
