CVE-2026-78624

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-78620

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

EUVD-2026-74178

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-78620 Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-78620 Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-78620

CVE-2026-78620 affects the Okta Access Gateway , specifically its Kerberos configuration handler , which fails to validate file paths supplied in event payloads before writing file contents. Because the attacker-controlled path is used directly as the write destination, files can be written to un...

EUVD-2026-74172

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-78624

Okta Access Gateway contains an improper path validation flaw in its backup restore function . The function does not validate the filename embedded in an encrypted backup payload, allowing file contents to be written to unintended locations on the appliance filesystem. The vulnerability is rated ...

CVE-2026-78624 Improper Path Validation in Okta Access Gateway Backup and Restore Functionality

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

Exploit for CVE-2026-74239

CVE-2026-74239 XenForo before 2.3.13 is vulnerable to path tr...

Security Bulletin: A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

Summary A path traversal vulnerability existed in two independent file handling mechanisms used by the product's workflow execution and file management capabilities. The file upload endpoint accepted multipart filenames directly from HTTP request metadata without sanitization, allowing an...

EUVD-2026-72759

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-74239

XenForo before 2.3.13 is affected by a path traversal vulnerability in the style archive importer on Windows deployments. Authenticated non-super administrators with style permissions can exploit backslash-based traversal sequences in ZIP member names to bypass forward-slash validation, writing a...

CVE-2026-74239 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-34223

A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...

CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859 Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-34223

A vulnerability has been identified in Desigo CC ClickOnce Client V6 All versions, Desigo CC ClickOnce Client V7 All versions, Desigo CC family V8 All versions, Desigo CC family V9 All versions, Desigo CC Flex Client V6 All versions, Desigo CC Flex Client V7 All versions, Desigo CC Installed Clie...