134614 matches found
EUVD-2026-61108
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service...
CVE-2026-47627
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service...
CVE-2026-47627
NVIDIA Triton Inference Server for Linux has a network-exploitable path traversal flaw (CVSS 9.8, no auth needed) that may allow arbitrary file access and denial of service. Exploitation details are not provided; apply NVIDIA advisory 5865 when available. Monitor for updates.
CVE-2026-47627
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service...
CVE-2026-47606
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...
CVE-2026-47606
NVIDIA Triton Inference Server for Linux is affected by an absolute path traversal vulnerability (CWE-36) in versions 0.0 through 26.05 . A remote attacker with no privileges can exploit this to achieve code execution and information disclosure . NVIDIA's CNA assigns a CVSS 3.1 score of 6.5 (Medi...
EUVD-2026-61107
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...
CVE-2026-47606
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure...
CVE-2026-74044
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...
CVE-2026-74038
Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...
CVE-2026-69160
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...
CVE-2026-68922
MobSF is a mobile application security testing tool used. Prior to 4.5.1, findiconpathzip in mobsf/StaticAnalyzer/views/android/iconanalysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containment,...
Security update for erlang
This update for erlang fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...
SUSE-SU-2026:3645-1 Security update for erlang
This update for erlang fixes the following issues: - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. - CVE-2026-42790:...
GO-2026-4950 Authorization bypass via double-encoded paths in github.com/valyala/fasthttp
In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '' as URI delimiters. In applications where authorization guards inspect ctx.Path before passing paths to file-serving...
CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...
CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...
EUVD-2026-61101
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...
CVE-2026-69160
In server/handles/sharing.go, strings.HasPrefix(requested_path, user.BasePath) fails to enforce a directory separator boundary. An authenticated user with CanShare permission and a BasePath like /base can create a share for a sibling path like /base2/secret.txt, then use the public share download...
CVE-2026-69160 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API
OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefixrequestedpath, user.BasePath without enforcing a directory separator boundary. An authenticated user with CanShare permission and a...