CVE-2026-101036 FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

DEBIAN-CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

EUVD-2026-88179

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion...

CVE-2026-94287

The libXpm library (versions before 3.5.19 ) is vulnerable to a denial of service due to an unsigned underflow in its write path. A local attacker can exploit this flaw to trigger unbounded CPU usage and memory exhaustion . No specific exploit information or in-the-wild exploitation details are p...

CVE-2026-38764

CVE-2026-38764 Unistal Systems Pvt. Ltd.의 Protegent 360 v2.0.0.4에서 발생한 문제로, 로컬 공격자가 커널 드라이버 pgsecdl.sys를 통해 권한을 상승시킬 수 있습니다...

CVE-2024-48990

CVE-2024-48990 POC 개요 Qualys는 needrestart가 버전 3.8 이전에서 로컬 공격자가 Python 인터프리터를 공격자가 제어하는 PYTHONPATH 환경 변수로 실행하도록 속여 루트 권한으로 임의 코드를 실행할 수 있음을 발견했습니다. 이 저장소는 CVE-2024-48990 에 대한 개념 증명PoC 익스플로잇 을 포함하고 있습니다. 취약점 요약 CVE ID: CVE-2024-48990 영향을 받는 구성 요소: needrestart 취약점 유형: 로컬 권한 상승 공격 벡터: 로컬 영향: 루트로 권한 상...

StrandHogg2

StrandHogg2 StrandHogg2 CVE-2020-0096에 대한 PoC 원본 취약점 정보 현재 설명 ActivityStartController.java의 startActivities에서 confused deputy로 인한 권한 상승 가능성이 있습니다. 이로 인해 추가 실행 권한 없이 로컬 권한 상승이 발생할 수 있습니다. 악용을 위해 사용자 상호 작용이 필요하지 않습니다. 제품: Android 버전: Android-8.0 Android-8.1 Android-9 Android ID: A-145669109 심각도 CVS...

CVE-2026-87723

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

EUVD-2026-88074

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

CVE-2026-87723

Google fuse-archive versions prior to 1.24 are vulnerable to an Untrusted Search Path (PATH Hijacking) . An attacker capable of prepending a directory to the PATH or writing a malicious binary to a writable directory within the PATH can hijack the execution pathway. This vulnerability allows for ...

CVE-2026-101080: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the file skillscan/tools/dir/diractions.py of the component File Access. The manipulation leads to path traversal. The attack needs to be performed locally. The exploit is publicly...

CVE-2026-101078: Improper Isolation or Compartmentalization

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend. Such manipulation leads to improper isolation or compartmentalization. The attack must be...

CVE-2024-42002

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

PT-2026-99923

Name of the Vulnerable Software and Affected Versions Tencent AI-Infra-Guard versions prior to 4.6.0 Description A path traversal issue exists within the File Access component, specifically affecting the startsWith function in the skill scan/tools/dir/dir actions.py file. This flaw allows a local...

CVE-2026-101131: Reliance on Untrusted Inputs in a Security Decision

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3. Impacted is an unknown function of the file packages/e2b/e2b/src/index.ts of the component dsh. The manipulation of the argument E2BAPIKEY leads to reliance on untrusted inputs in a security decision. Local access is...

CVE-2026-101036: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

CVE-2026-101079: Reliance on Untrusted Inputs in a Security Decision

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be...

CVE-2022-37705

제안된 설명 Amanda 3.5.1에서 백업 사용자를 루트 권한으로 승격시킬 수 있는 권한 상승 결함이 발견되었습니다. 취약한 구성 요소는 runtar SUID로, 공격자가 제어할 수 있는 특정 인수로 /usr/bin/tar를 실행하는 래퍼일 뿐입니다. 이 프로그램은 tar 바이너리에 전달된 인수를 올바르게 검사하지 않습니다 모든 인수가 --ARG VALUE 형식일 것이라고 가정하지만 --ARG=VALUE를 하나의 인수로 제공할 수 있습니다. 추가 정보 이 결함은 코드 실행, 서비스 거부, 권한 상승 및 정보 공개에 악용될 수...