491990 matches found
EUVD-2026-105333
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...
CVE-2026-92390
The curl utility (versions prior to 8.23.0 ) is vulnerable to a local file overwrite flaw when using the --remote-header-name (-J) flag. The root cause is a failure to preserve documented anti-clobbering protections under specific conditions: if an intermediate 103 Early Hints response precedes t...
CVE-2026-92390
When invoked with "--remote-header-name" "-J", curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an "ETag" header is processed before "Content-Disposition" under "--etag-save". This flaw allows an...
CVE-2026-92390
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
EUVD-2026-105320
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...
CVE-2026-113721
A flaw was found in virtualenv. A local attacker can exploit this issue by pre-creating symbolic or hard links in a destination directory before an environment is set up. Because virtualenv does not properly check or replace existing links when writing configuration and activation files, it can...
AZL-110121 CVE-2026-113719 affecting package python-virtualenv 20.36.1-9
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
DEBIAN-CVE-2026-113719
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
DEBIAN-CVE-2026-113721
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...
CVE-2026-113719
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall.uninstallpreviousversion accepts existing seed-package metadata and uninstalldist joins entries from toplevel.txt and RECORD to site-packages without checking containment. When a reused destinatio...
CVE-2026-113721
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, ViaTemplateActivator.generate removes an existing output only when Path.exists is true, allowing a dangling symlink to survive and redirect generated activation content, while PyEnvCfg.write opens pyvenv.cfg...
CVE-2026-113719
A flaw was found in virtualenv. This vulnerability allows a local attacker to cause arbitrary file deletion outside the target environment directory. When creating an isolated environment in a reused directory, virtualenv processes existing package metadata during cleanup without verifying that...
CVE-2026-113716
A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...
CVE-2026-112948
A flaw was found in vitest. Vitest development servers fail to properly enforce file access restrictions, permitting access to paths that should be denied. An attacker who can reach an affected development server or who tricks a user into visiting a malicious website can exploit this flaw to read...
CVE-2026-112942
A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...
Exploit for CVE-2026-87690
CVE-2026-87690 Path traversal CWE-22 in Metasploit Framewor...
CVE-2026-112940
A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the component reopens SQLite database and auxiliary files by file path rather than retaining secure file descriptors. A local attacker with file renaming permissions in a shared directory can swap these filenames during...
CVE-2026-113672
A flaw was found in Argo CD. When processing Jsonnet files, the application does not restrict file imports to the intended repository, allowing files outside of it to be read. This can lead to disclosure of sensitive information, such as credentials and access tokens, and may also result in a...