CVE-2026-72762

n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in the Edit Image node, which passes its output format parameter to the underlying image library without validation. An authenticated user able to run workflows can supply a crafted format value to writ...

CVE-2026-72762

n8n has an arbitrary file write vulnerability in the Edit Image node affecting versions before 1.123.67, 2.31.5, and 2.32.1. An authenticated user who can run workflows can pass a crafted format value, which is forwarded to the underlying image library without validation, enabling writing arbitra...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities

A flaw was found in Apache Thrift. This vulnerability encompasses an origin validation error, improper limitation of a pathname to a restricted directory path traversal, and improper neutralization of CRLF sequences in HTTP headers HTTP request/response splitting. A remote attacker could exploit...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604 Intelliants Subrion CMS - Path Traversal

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

EUVD-2026-56043

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604

CVE-2026-72604 affects Intelliants Subrion CMS up to version 4.2.1. A path traversal flaw in the admin panel file deletion endpoint allows an authenticated administrator to pass a user-supplied path to unlink() without sanitization or path canonicalization, enabling deletion of arbitrary files ou...

CVE-2026-72602

CVE-2026-72602 affects AsyncFuncAI deepwiki-open. A path traversal flaw in the local-repository structure endpoint (through commit 16f35a0) allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths, since WIKI_AUTH_MODE defaults to false. This enables enu...

CVE-2026-72602 AsyncFuncAI deepwiki-open - Path Traversal

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

EUVD-2026-56041

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

SUSE-SU-2026:23064-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

CVE-2026-33922

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

EUVD-2026-55996

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...

CVE-2026-33922

CVE-2026-33922: Path traversal in the Offline archives feature of the Arc local web interface (Arc before v2.7.0). A local user with administrative Web UI credentials can submit an archive name containing traversal sequences to delete arbitrary files accessible to the Arc process, which runs with...