1404 matches found
SUSE CVE-2026-55073
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-84828 Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
CVE-2026-84828
A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...
PYSEC-2026-3940 weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
PYSEC-2026-3934 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...
Linux Distros Unpatched Vulnerability : CVE-2026-84828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command...
PT-2026-89361
A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...
weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
GHSA-JF6Q-CHMF-3H3V weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...
CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...
Arbitrary Local File Read
NLTK is vulnerable to an Arbitrary Local File Read. The vulnerability is due to StreamBackedCorpusView directly calling builtins.open instead of the security-enforcing pathsec.open, which allows an attacker who controls the fileid argument to bypass the ENFORCE setting and read arbitrary local...
PT-2026-89202
Name of the Vulnerable Software and Affected Versions GitHacker versions prior to 1.1.8 Description GitHacker fails to validate path segments parsed from an attacker-controlled .git/HEAD file before joining them to the output directory. A malicious server can coerce the tool into reading arbitrar...
CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...
CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...
CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...
Server-side Request Forgery (SSRF)
Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbou...
GHSA-4HHP-H66F-J5J7 vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...
vLLM: SSRF + arbitrary local file read in MiMoV2OmniMultiModalProcessor `_fetch_image` and audio loader bypass MediaConnector protections
Summary vllm/transformersutils/processors/mimov2omni.py — the multimodal processor for MiMoV2OmniForCausalLM — issues requests.get... directly on user-supplied image and audio URL strings and Image.open... on user-supplied local paths, without the SSRF / allowedlocalmediapath checks that...
