412534 matches found
CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...
UBUNTU-CVE-2026-82343
A flaw was found in the file-psd plugin in GIMP. When processing a specially crafted PSD image file, the plugin does not properly validate the channel-count parameter. This incorrect validation leads to improper memory bounds checking, resulting in both a heap out-of-bounds read and a stack...
CVE-2026-77939
Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...
CVE-2026-66324
External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-55569
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...
CVE-2026-55552
Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...
CVE-2026-77063
multer , a Node.js middleware for handling multipart/form-data, contains a race condition in its file stream handling that is triggered when an application uses an asynchronous fileFilter together with the fileSize limit . An attacker can exploit this to cause a file that exceeds the configured s...
CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. A...
CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...
CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a delete...
CVE-2026-77037
multer is a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0 , when a disk-backed upload is aborted or truncated before the write stream finishes, the disk storage engine removes the visible file but fails to close the underlying write file descriptor , leaving a dele...
CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
EUVD-2026-67866
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
CVE-2026-82020
Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability. Sensitive-path guards that should protect the credential store failed to exclude the auth.json file , allowing an attacker who can influence ingested message content to craft a malicious messa...
CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...
EUVD-2026-66245
CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...
CVE-2026-81849
amazon-ssm-agent prior to version 3.3.4515.0 contains a path traversal vulnerability in its aws:downloadContent plugin. The root cause is an improper limitation of a pathname to a restricted directory, allowing an authenticated remote user with restricted ssm:SendCommand permission (limited to th...
CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent
Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...