490062 matches found
SUSE CVE-2026-112944
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...
SUSE CVE-2026-114236
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process' file descriptor limit...
CVE-2026-76304
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator URL of the Splunk SOAR instance, the...
CVE-2026-76304 Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator URL of the Splunk SOAR instance, the...
CVE-2026-76304
In Splunk SOAR versions below 8.7.0 , an authenticated user without permissions to edit Automation Brokers can download the Docker Compose configuration file . This is caused by a failure to enforce proper authorization checks when returning the configuration file. The disclosed file contains the...
CVE-2026-76304 Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could download the Splunk SOAR Automation Broker Docker Compose configuration file. The file contains the Uniform Resource Locator URL of the Splunk SOAR instance, the...
GHSA-CW65-GX24-RC82 virtualenv: Builtin creation follows linked environment directories
Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15...
virtualenv: Builtin creation follows linked environment directories
Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as ANT-2026-MUFJEG11 in virtualenv-20261015-005, received on 15...
CVE-2026-114140
A flaw was found in nbconvert. This flaw allows an attacker to perform an arbitrary file write by enticing a user to convert a maliciously crafted Jupyter notebook. Due to improper path validation in ExtractOutputPreprocessor, attacker-controlled cell output metadata can traverse outside the targ...
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
DEBIAN-CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-109741
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Storage: Bucket File System component...
External Control of File Name or Path
Overview pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the SVG rendering path in src/Renderer.js, where local images embedded within SVG content bypass the setLocalAccessPolicy...
CLSA-2026-1792612283 libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
CLSA-2025-1761139764 kernel: Fix of 39 CVEs
nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...