110119 matches found
PT-2026-108581
Security vulnerability affects the argo-workflows package. launch-editor allows users to open files with line numbers in editor from Node...
CVE-2026-102366: Unrestricted Upload of File with Dangerous Type
mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...
PT-2026-102454
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
PT-2026-102707
Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An unauthenticated path traversal issue exists where the component accepts upload-field state as guest-controlled JSON during public form submission. If the auto-reply and attach uploaded fil...
PT-2026-102797
Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Improper validation of an attacker-controlled file path allows a local authenticated attacker to change the ownership of arbitrary files. Recommendations At the moment, there is no information about a...
PT-2026-102904
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...
Linux Distros Unpatched Vulnerability : CVE-2026-87798
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 o...
PT-2026-102831
A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...
CVE-2026-92368: Heap-based Buffer Overflow
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...
CVE-2026-86157: Exposed Dangerous Method or Function
Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...
SUSE CVE-2026-88808
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
DEBIAN-CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
UBUNTU-CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 are vulnerable to a path traversal vulnerability within the files view. The root cause is the improper validation of the path parameter before it is passed to the output_file function. This allows authenticated users with Events view permission to read arb...