hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation

A flaw was found in HP Linux Imaging and Printing HPLIP software. Multiple vulnerabilities exist that could allow a remote attacker to achieve remote code execution, escalate privileges, cause a denial of service, disclose information, or modify files without authorization under certain condition...

Checkov by Prisma Cloud: Path Traversal Vulnerabilities

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem. Work around: Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration...

POC-CVE-2025-24813

CVE-2025-24813 – Demonstration Environment PoC This repository contains a simple application built to observe the behavior of CVE-2025-24813, a recent vulnerability in Apache Tomcat related to the use of the DefaultServlet with writing enabled readonly=false, allowing unsafe write operations via...

CVE-2026-110735

The Godot Engine (through version 4.7.2 ) is vulnerable to a heap out-of-bounds write in the binary resource loader, specifically within core/io/resource_format_binary.cpp at ResourceLoaderBinary::get_unicode_string. The root cause is a signed to unsigned conversion error (CWE-195) where a string...

CVE-2026-110591

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded...

CVE-2026-110262

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class files. Attackers can craft bytecode with many forward jump targets in constructors, causing unbounded stack copies in...

CVE-2026-110259

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded...

CVE-2016-20099

L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1importerprobe in importer/vc1imp.c that allows attackers to hang applications via crafted input files. Attackers can supply a file consisting only of zero bytes, which lsmashreadfile probes automatically, causing indefinite CPU...

CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717

The Janus WebRTC Server (versions through 1.4.3 ) contains a path traversal vulnerability within the Record&Play plugin . This flaw allows unauthenticated attackers to bypass the recordings_path restriction by supplying filenames with path separators during a record request. Consequently, attacke...

EUVD-2026-101140

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

EUVD-2026-101130

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

CVE-2026-110657

The Khronos NNEF-Tools packages, specifically nnef through version 1.0.10 and nnef-tools through version 1.0.11, are vulnerable to a path traversal vulnerability (CWE-22). This flaw allows an attacker to write files outside the intended model directory by providing a graph.nnef file containing cr...

CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

CVE-2026-110690

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

EUVD-2026-101260

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module...

CVE-2026-110591

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze that allows attackers to exhaust memory and CPU via crafted class files. Attackers can supply class files analysed through BasicVerifier, SimpleVerifier or SourceInterpreter to trigger unbounded...

CVE-2026-110591

OW2 ASM versions 1.4.3 before 9.11 are vulnerable to excessive resource consumption within the Analyzer.analyze() function. An attacker can provide specially crafted class files analyzed via BasicVerifier, SimpleVerifier, or SourceInterpreter to trigger unbounded per-instruction Frame allocation ...