CVE-2026-51906: Improper Limitation of a Pathname to a Restricted Directory

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...

FortiMail Graphical Interface Arbitrary File Write

The vulnerability of the FortiMail email protection system’s graphical interface is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a malicious actor to write arbitrary files using specially crafted HTTP requests...

Unauthenticated path traversal vulnerability exists in the Brocade ASCG (CVE-2026-85487)

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

PT-2026-104405

Name of the Vulnerable Software and Affected Versions Nx versions 13.10.0 through 22.7.9 Nx versions 23.0.0 through 23.2.0 Description Nx migration planning fails to validate that the nx-migrations.migrations value read from a target package manifest is a contained relative path. A hostile direct...

Arbitrary File Write via Path Traversal during Support Bundle Extraction in Brocade ASCG before 3.5.0 (CVE-2026-85490)

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting...

CVE-2026-103648: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

PCRE2 Heap Buffer Overflow DoS

The vulnerability of the PCRE2 regular expression library is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

CVE-2026-51907

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-104853: Improper Limitation of a Pathname to a Restricted Directory

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package...

openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21983-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21983-1 advisory. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204:...

CVE-2025-71427

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

Exploit for CVE-2026-104286

FortiMail CVE-2026-104286 Path Traversal Exploit Overview...

GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...

GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

EUVD-2026-91042

An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...

CVE-2026-104286

Fortinet FortiMail is vulnerable to a critical path traversal vulnerability (CVE-2026-104286 ) affecting versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9 when the IBE function is enabled. The root cause involves a combination of Path Traversal (CWE-22) and insufficient neutralizati...

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

DescriptionA language pack ships a Plural-Forms header saying how the language counts, for example nplurals=2; plural=n != 1;. JupyterLab turns that string into a function with new Function, so the header gets executed. The check that meant to keep it safe was a regular expression. The regex was...

Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

At a glance- Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data- Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink wi...

PYSEC-2026-4030 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

At a glance - Actor: attacker who controls the -o/--output argument to trestle author catalog,profile,ssp-generate e.g. via a CI pipeline that derives the output directory from repository-controlled data - Primitive: attacker-controlled --output value reaches trestleroot / args.output write sink...