CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

GO-2026-4509 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3792 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2024-3271 vulnerabilities

Vulnerabilities for packages: rclone...

GO-2026-5031 vulnerabilities

Vulnerabilities for packages: seaweedfs...

GO-2025-4101 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2026-4352 vulnerabilities

Vulnerabilities for packages: opentofu...

GO-2023-1709 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3793 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-5048 vulnerabilities

Vulnerabilities for packages: bento, dapr, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2023-2069 vulnerabilities

Vulnerabilities for packages: croc...

GHSA-X2R2-RVHQ-2MQV vulnerabilities

Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry, geoserver...

CVE-2026-73430 vulnerabilities

Vulnerabilities for packages: yazi...

CVE-2026-16896

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use TOCTOU race condition...

CVE-2026-16896

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use TOCTOU race condition...

EUVD-2026-58378

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use TOCTOU race condition...

CVE-2026-16896

IBM i versions 7.3–7.6 are affected by CVE-2026-16896 (TOCTOU race condition in Network Authentication Service). Local authenticated attackers could obtain unauthorized access to files due to a TOCTOU flaw. Affected products: IBM i 7.3, 7.4, 7.5, 7.6. Remediation: apply the fixed PTFs per version...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the --filter process. An attacker can gain unauthorized access to files by injecting malicious merge file directives that override intended module-level filter restrictions. Remediation A fix was pushed into...