22452 matches found
PT-2026-107890
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 Windows only lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The service registers its COM classes with no DCO...
RHEL 9 : resteasy (RHSA-2026:77297)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77297 advisory. RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified...
EulerOS 2.0 SP15 : perl-Archive-Tar (EulerOS-SA-2026-3934)
According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.x000D x000...
EUVD-2026-92804
Docling has arbitrary file read/write and command execution when shell-escape is enabled when rendering untrusted TikZ with the opt-in Tectonic engine...
GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
Unsafe Dependency Resolution
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the readTranslationsFile method in the i18n theme engine, where a locale value is used to construct a file path without first validating that the resolved path remains with...
Deserialization of Untrusted Data
Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Deserialization of Untrusted Data in sanitizeMkdocsYml within mkdocsPatchers.ts via malforme...
Symlink Attack
Overview @backstage/plugin-scaffolder-backend-module-bitbucket-server is a The Bitbucket Server module for @backstage/plugin-scaffolder-backend Affected versions of this package are vulnerable to Symlink Attack via the pull request workspace copy logic in bitbucketServerPullRequest.ts and the...
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
authenticated RCE and arbitrary file read via Chromium vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
GHSA-9GVV-QJJ3-2P6G Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
Exploit for CVE-2026-21589
CVE-2026-21589 - Jira/Confluence/Bitbucket Arbitrary File Read...
CVE-2026-58069
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host...
Exploit for CVE-2026-21589
CVE-2026-21589 — Atlassian Pre-Auth Arbitrary File Read → Crow...
CVE-2026-58069
A vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host. This issue impacts Windows-based deployments. The vulnerability was resolved in the following versions: Veeam Backup & Replication 13.1 (build 13.1.0.41...
CVE-2026-58069
This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host...
