54070 matches found
PT-2026-78285
Name of the Vulnerable Software and Affected Versions Simple File List WordPress plugin versions prior to 6.3.12 Description Unauthenticated users can exploit a lack of validation in the source path of a file-move operation. This allows an attacker to read arbitrary files on the server and reloca...
PT-2026-78786
Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform path traversal during the archive extraction process of the Universal Forwarder installer. This occurs because the credentials-package extraction...
PT-2026-78442
Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to...
PT-2026-78481
Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description In the tarfile module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves th...
UBUNTU-CVE-2026-17106
The tar extraction routines in moby/go-archive Unpack, UnpackLayer, U...
UBUNTU-CVE-2026-68939
Pyenv provides simple Python version management. Prior to 2.8.0, isve...
ALSA-2026:57015 Moderate: glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...
PT-2026-78785
Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A path traversal issue exists in the archive extraction routine during app installation. This occurs because the system fails to validate that extracted file paths remain within the intended...
PT-2026-78744
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can move files readable...
PT-2026-78683
Name of the Vulnerable Software and Affected Versions yangzongzhuan RuoYi-Vue versions prior to 3.9.3 Description A path traversal issue exists in the Common Download Endpoint within the fileDownload and resourceDownload functions of the CommonController.java file. A remote attacker can manipulat...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...
CVE-2026-70666
creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:18+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww 2026-08-19 09:32:00+00:00| seen| https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8...
CVE-2026-73974
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...
CVE-2026-52875
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...
CVE-2026-48796
CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...
CVE-2026-50186
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
CVE-2026-47699
Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...
CVE-2026-50186 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export
4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...
