CVE-2026-73642 Path Traversal in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4...

CVE-2026-73642 Path Traversal in Dayforce ESS Excelity

Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4...

CVE-2026-73642

The Dayforce Payroll software is vulnerable to a Path Traversal flaw within its file download functionality. An unauthenticated attacker can exploit this by sending a GET request with a manipulated file path parameter, potentially allowing access to any path, including absolute local file paths ....

PT-2026-99492

Name of the Vulnerable Software and Affected Versions WebFacing™ WordPress plugin versions prior to 5.4 Description An issue exists where the software fails to restrict access to a bundled script and does not validate a user-supplied path before including a local file. This allows unauthenticated...

CVE-2026-100526

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

CVE-2026-100526

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

CVE-2026-100526 Vulnerability in discord

OpenClaw's Discord integration npm package @openclaw/discord before version 2026.9.3 could lose the sender-scoped media policy in the emoji and sticker upload actions before loading a local file. A sender permitted to invoke those actions could cause OpenClaw to read a host path that the same...

CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

DEBIAN-CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

UBUNTU-CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91841

A flaw exists in NetworkManager-vpnc , a VPN plugin for NetworkManager, which allows a local unprivileged user to achieve local privilege escalation . By injecting a newline character into the CA-File path , an attacker can manipulate the plugin to execute arbitrary commands as the root user . Th...

CVE-2026-91841 Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91841 Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

EUVD-2026-87251

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91841

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

CVE-2026-91841: Improper Neutralization of CRLF Sequences

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege...

PT-2026-98207

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.12 Description Cross site scripting occurs in the Media Filename Handler component due to improper handling of the file path argument within the html function of the PlaylistManager.js file. This allow...

External Control of File Name or Path

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-77257 MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...