EUVD-2022-0753

Malicious code in bioql PyPI...

EUVD-2024-34269

Malicious code in bioql PyPI...

EUVD-2022-44222

Malicious code in bioql PyPI...

EUVD-2024-34270

Malicious code in bioql PyPI...

EUVD-2025-13899

Malicious code in bioql PyPI...

EUVD-2024-39303

Malicious code in bioql PyPI...

EUVD-2022-44223

Malicious code in bioql PyPI...

EUVD-2025-17638

Malicious code in bioql PyPI...

EUVD-2023-35455

Malicious code in bioql PyPI...

EUVD-2025-30264

Malicious code in bioql PyPI...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the validLogFileName and validExecOutputFileName functions, which insufficiently validate log file names, allowing traversal sequences after certain prefixes. An attacker can access sensitive files on the host...

USN-7782-1: Ghostscript vulnerabilities

It was discovered that Ghostscript incorrectly handled opening a file to write. An attacker could possibly use this issue to cause Ghostscript to crash, resulting in a denial of service CVE-2025-7462 It was discovered that Ghostscript incorrectly handled writing certain files. An attacker could...

SUSE CVE-2025-59342

esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a...

The vulnerability of the open-source Kea DHCP server arises from improper external management of the filename or path, allowing attackers to gain write access to arbitrary files.

The vulnerability of the open-source Kea DHCP server is related to incorrect external management of the file name or path. Exploiting this vulnerability can allow an attacker to gain write access to arbitrary files...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the streamhandler function in the file handler component when manipulating the key argument. An unauthenticated user can access sensitive information by sending specially crafted requests remotely. Details A...

ROS-20250925-03

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of the directory with restricted directory. Python programming language interpreter CPython functions...

CVE-2025-10854

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

OpenAI Codex CLI 输入验证错误漏洞

OpenAI Codex CLI is an OpenAI open source lightweight coding agent software that runs in the terminal. An input validation error vulnerability exists in OpenAI Codex CLI versions 0.2.0 through 0.38.0, which stems from an error in the sandbox configuration logic and could lead to arbitrary file...

txtai 安全漏洞

txtai is an AI framework open-sourced by NeuML. A security vulnerability exists in txtai that stems from not properly handling symbolic links in compressed tar files, which could lead to arbitrary file writes...