CVE-2026-105676

Ghost, a Node.js content management system , is vulnerable to a path traversal flaw in how it loads theme translation files. Affected versions range from 1.20.0 until 6.64.0 . An authenticated Administrator can exploit this vulnerability to read JSON files outside of the active theme's directory,...

mud-visualizer

제조업체 사용 설명서 MUD 시각화 도구 경고: mud-visualizer는 현재 베타 버전입니다. 사용에 따른 위험은 본인이 감수하십시오. 이 도구는 JSON 형식의 MUD 파일을 시각화하는 데 사용할 수 있습니다. 목차 동기 설치 지원되는 MUD 추상화 기여 지원 인용 라이선스 동기 MUD 파일은 디바이스의 ACL 규칙을 포함하는 JSON 형식의 일반 텍스트 파일입니다. MUD 파일에는 수십 또는 수백 개의 ACL 규칙이 포함될 수 있으므로 수동으로 파일을 읽고 검증하기 어렵습니다. mud-visualizer는 MUD 파일...

digital-forensics-lab

Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository Features of Repository Interactive Digital Forensics Labs: Tailored for students and faculty engagement Linux-Centric Lab Environment: Utilizes Kali Linux exclusively for all labs Visual Learning Support: Each lab includes...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: ▶ grep -HnrE...

CVE-2026-105125

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125 LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint

LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the lang route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or...

CVE-2026-105125

LaraDashboard versions prior to 1.4.8 are vulnerable to a path traversal vulnerability within the /api/translations/{lang} endpoint. This flaw allows unauthenticated attackers to read sensitive JSON files, such as composer.json, by manipulating the {lang} route segment. Specifically, on Windows h...

CVE-2026-104417

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-104417

The Ghost platform (versions 1.20.0 before 6.64.0 ) is vulnerable to a path traversal flaw in the theme translation file loading mechanism. This issue allows authenticated administrators to manipulate the locale setting to load JSON files from locations outside the active theme directory. Success...

CVE-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

EUVD-2026-91428

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

CVE-2026-100637

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

CVE-2026-100637 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

CVE-2026-100637 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

CVE-2026-100637

SiYuan versions before v3.8.4 are vulnerable to a path traversal vulnerability within the checkoutRepo endpoint. This flaw allows authenticated administrators to write JSON files outside the designated workspace by supplying a sessionID parameter containing directory traversal sequences. Successf...

Astra Linux - Vulnerability in libfastjson

json-c through version 0.14 is vulnerable to an integer overflow and an out-of-bounds write when processing a large JSON file, as demonstrated by printbufmemappend...

praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location

Summarypraisonaiagents/memory/filememory.py::FileMemory.init constructs allmemory file paths by directly joining the userid parameter to a base path:pythonself.userpath = self.basepath / userid LINE 145 — no sanitizationNo validation or normalization is applied to userid before the path join.An...

CVE-2024-7952

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

EUVD-2024-55741

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...