116762 matches found
GHSA-5M9F-RPHJ-C435 vulnerabilities
Vulnerabilities for packages: traccar, logstash-fips, thingsboard, logstash, zipkin, cassandra-reaper, conductor-fips, druid, conductor, nuxeo, traccar-fips...
GHSA-PCW8-M77R-2528 vulnerabilities
Vulnerabilities for packages: nextcloud-server...
CVE-2024-41909 vulnerabilities
Vulnerabilities for packages: hadoop-fips...
CVE-2026-69220 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, logstash, druid, zipkin, thingsboard...
CVE-2026-69219 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, logstash, druid, zipkin, thingsboard...
logto-tunnel serves files outside --experience-path via path traversal
Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...
GHSA-RXJR-6C9Q-H67X logto-tunnel serves files outside --experience-path via path traversal
Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...
AZL-97035 CVE-2026-75593 affecting package moby-engine 25.0.3-19
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...
CVE-2026-75593
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...
CVE-2026-63188
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...
CVE-2026-16888
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a path traversal vulnerability...
CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
CVE-2026-76576
The CommonController.java fileDownload/resourceDownload function in RuoYi-Vue up to 3.9.2 allows remote path traversal via the fileName/resource argument. CVSS 4.3 (MEDIUM). A PoC exploit exists; the vendor has not responded. No patch version is provided in the documents.
CVE-2026-76576 yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
EUVD-2026-62846
A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2. This impacts the function fileDownload/resourceDownload of the file ruoyi-admin/src/main/java/com/ruoyi/web/controller/common/CommonController.java of the component Common Download Endpoint. Performing a manipulation of the argumen...
CVE-2026-75593
Prior to BuildKit 0.31.2, a client with control API access can craft an upload request causing files to escape the BuildKit state directory, enabling directory traversal. Fixed in v0.31.2. No exploitation details provided; CVSS 7.2 HIGH (network, low complexity, low privileges required).
CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...
EUVD-2026-62839
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...
CVE-2026-75593 BuildKit: Malicious client can bypass destination directory validation on local sources upload
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...