491587 matches found
External Control of File Name or Path
Overview pdfmake is a Client/server side PDF printing in pure JavaScript Affected versions of this package are vulnerable to External Control of File Name or Path via the SVG rendering path in src/Renderer.js, where local images embedded within SVG content bypass the setLocalAccessPolicy...
libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
CLSA-2026-1792612283 libtiff: Fix of 22 CVEs
CVE-2018-16335: validate file size before chopping up a single strip...
CLSA-2025-1761139764 kernel: Fix of 39 CVEs
nfs: fix UAF in direct writes CVE-2024-26958 - NFSD: Fix the behavior of READ near OFFSETMAX CVE-2022-48827 - thermal: core: prevent potential string overflow CVE-2023-52868 - ath5k: fix OOB in ath5keepromreadpcalinfo5111 CVE-2021-47633 - RDMA/cma: Ensure rdmaaddrcancel happens before issuing...
CVE-2026-114379
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
EUVD-2026-107558
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379
A file inclusion vulnerability exists in EKKOLearnAI ekko-studio versions up to 1.0.6 . The flaw is located in the Media Generation API component, specifically within the saveGeneratedImages function of the file packages/server/src/modules/studio/controllers/media.ts. An attacker can manipulate t...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
CVE-2026-114379 EKKOLearnAI ekko-studio Media Generation API media.ts saveGeneratedImages file inclusion
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument outputpath causes file inclusion...
EUVD-2026-104646
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140
The nbconvert tool (jupyter nbconvert) versions 5.4.0 through 7.17.2 contains a path traversal vulnerability in the ExtractOutputPreprocessor component located at nbconvert/preprocessors/extractoutput.py. The flaw exists because the tool joins attacker-controlled cell output metadata filenames wi...
CVE-2026-114140 nbconvert: File write via path traversal in cell output filenames
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-114140
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocessor in nbconvert/preprocessors/extractoutput.py joins the attacker-controlled cell output metadata filename to outputfilesdir without...
CVE-2026-85518
A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...
DEBIAN-CVE-2026-85518
A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted...