Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-50143

In @apify/actors-mcp-server versions before 0.10.11, getActorMCPServerURL() in src/mcp/actors.ts:44 naively concatenates a trusted base URL with an attacker-controlled webServerMcpPath, allowing an @ character to inject an arbitrary hostname. Node.js's WHATWG URL parser treats the prefix as useri...

CVE-2026-50143 Actor MCP path authority injection leaks Apify token

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922

In MobSF versions before 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py constructs paths from the manifest android:icon value without sanitizing traversal or verifying containment. An authenticated user can upload a crafted ZIP/APK to read server files matching A...

EUVD-2026-61132

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

CVE-2026-68922 MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads

MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...

OPENSUSE-SU-2026:21606-1 Security update for python-unearth

This update for python-unearth fixes the following issues: Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass directory containment checks bsc1275440...

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

EUVD-2026-61076

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

CVE-2026-74044

Wazuh versions 4.0.0 through 4.14.5 are vulnerable: an authenticated cluster peer with a valid Fernet key can supply a path-traversal-shaped node name in the cluster hello payload; on disconnect, the master's peer cleanup routine deletes arbitrary directory contents within the wazuh user's writab...

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

CVE-2026-74038

Wazuh 4.0.0 before 4.14.6 is vulnerable: insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() allow an unauthenticated attacker to enroll an agent named ".." via the enrollment port, resolving traversal to the parent queue directory and deleting its subdirect...

EUVD-2026-61074

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...