CVE-2026-63328 Trivy: Path Traversal in Trivy Plugin Manager Allows Arbitrary File Write

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

EUVD-2026-60957

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-63328

Trivy versions prior to 0.72.0 use plugin manifest metadata in pkg/plugin/manager.go to build paths under ~/.trivy/plugins without confining plugin names to that root. A crafted plugin.yaml can escape the directory, letting an attacker who persuades a user to install a malicious plugin overwrite ...

CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68939 Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68939 Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-68939

Pyenv provides simple Python version management. Prior to 2.8.0, isversionsafe in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENVVERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix,...

CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

CVE-2026-48798

SSH.NET (a .NET SSH library) is vulnerable to arbitrary file write via its ScpClient.Download(string, DirectoryInfo) method. The method trusts file and directory names returned by a remote SCP server during recursive downloads without containment validation. A malicious, compromised, or man-in-th...

EUVD-2026-60945

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

CVE-2026-48798

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

CVE-2026-48798 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

GO-2026-6109 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList

OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API in github.com/OpenListTeam/OpenList...

CVE-2026-45532

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILESEPARATOR is , while the server only filters the / character during string truncation. The vulnerability has been fixed in...

CVE-2026-18751

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607...

CVE-2026-45532

DataEase versions prior to 2.10.23 on Windows have a path traversal flaw: the server only filters /, allowing attackers to traverse directories via \. The fix is in v2.10.23; no workarounds exist. CVSS 4.0 scores 8.7 (HIGH) with network access and no authentication required. No exploitation detai...

CVE-2026-45532 DataEase has a Path Traversal Vulnerability

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILESEPARATOR is , while the server only filters the / character during string truncation. The vulnerability has been fixed in...

EUVD-2026-60760

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILESEPARATOR is , while the server only filters the / character during string truncation. The vulnerability has been fixed in...

CVE-2026-45532 DataEase has a Path Traversal Vulnerability

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILESEPARATOR is , while the server only filters the / character during string truncation. The vulnerability has been fixed in...