CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

EUVD-2026-67866

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

CVE-2026-82020

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability. Sensitive-path guards that should protect the credential store failed to exclude the auth.json file , allowing an attacker who can influence ingested message content to craft a malicious messa...

EUVD-2026-66245

CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file...

CVE-2026-81849

amazon-ssm-agent prior to version 3.3.4515.0 contains a path traversal vulnerability in its aws:downloadContent plugin. The root cause is an improper limitation of a pathname to a restricted directory, allowing an authenticated remote user with restricted ssm:SendCommand permission (limited to th...

CVE-2026-81849 Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the...

EUVD-2026-42983

Snipe-IT vulnerable to directory traversal in displaySig...

EUVD-2026-67850

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Yamcs has Unauthenticated Directory Traversal

Attack type: Unauthenticated remote Impact: Attackers can access any system files from the underlying host. Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs Steps to Reproduce: 1. Start Yamcs and login as a...

GHSA-9JG3-G3WH-W9PJ Yamcs has Unauthenticated Directory Traversal

Attack type: Unauthenticated remote Impact: Attackers can access any system files from the underlying host. Affected components: HttpRequestHandler.java, StaticFileHandler.java An Unauthenticated Directory Traversal vulnerability exists in Yamcs Steps to Reproduce: 1. Start Yamcs and login as a...

CVE-2026-55552

Yamcs is a mission control framework affected by an unauthenticated directory traversal in StaticFileHandler.locateFile (yamcs-core). The method resolves request paths without calling Path.normalize and Path.toAbsolutePath to verify the result stays within the configured staticRoots, allowing tra...

CVE-2026-55552 Yamcs: Unauthenticated Directory Traversal

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-55552 Yamcs: Unauthenticated Directory Traversal

Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segment...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939 Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

EUVD-2026-67837

Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via the POST /api/v1/query endpoint...

CVE-2026-77939

Flextype CMS through v1.0.0-dev is affected by an expression language injection in its Symfony ExpressionLanguage engine , reachable via the POST /api/v1/query endpoint. Unsanitized, user-supplied input is passed to the engine, exposing application objects such as filesystem() and serializers() w...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...