54706 matches found
CVE-2026-69086 SiYuan before v3.7.3 Path Traversal via unvalidated avID
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish...
mariadb: mbstream: Unauthorized file creation via path traversal
A flaw was found in MariaDB's mbstream utility. This vulnerability allows a highly privileged local attacker, who can provide a specially crafted archive, to create files outside of the intended target directory. This is due to mbstream not properly validating paths containing directory traversal...
Important: Red Hat Security Advisory: mariadb10.11 security update
An update for mariadb10.11 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...
CVE-2026-67970
Incorrect access control in the DSSetDestPathCmd component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal...
CVE-2026-67970
The connected documents confirm a vulnerability in NASA cFS v7.0.1 involving the DS_SetDestPathCmd() component, where incorrect access control enables path traversal to access sensitive components. The issue is described consistently across NVD, CVE records, EUVD ENISA, and CVE listings. The CVSS...
Linux Distros Unpatched Vulnerability : CVE-2026-61372
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through...
VulnCheck KEV: CVE-2026-54066
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
Important: mingw-glib2 security update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...
CVE-2026-9856
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
EUVD-2026-52005
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
CVE-2026-9856
The CVE-2026-9856 entry describes a path traversal flaw in huggingface/transformers
CVE-2026-9856
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
CVE-2026-9856 Path Traversal in huggingface/transformers
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
CVE-2026-9856 Path Traversal in huggingface/transformers
A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...
Exploit for Path Traversal in Stitionai Devika
CVE-2024-40422 Python implementation...
VulnCheck KEV: CVE-2023-2825
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups...
PT-2026-67349
Name of the Vulnerable Software and Affected Versions huggingface/transformers versions prior to 5.8.0.dev0 Description An issue allows arbitrary file writes through path traversal, a technique used to access files and directories outside the intended folder. The flaw exists in the save pretraine...
VulnCheck KEV: CVE-2025-71324
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile, where a fallback file-lookup path constructed...
Weechat -- Multiple vulnerabilities
The Weechat project reports: core: fix buffer overflow in display of time in chat area with a custom time format core: fix integer overflow in size calculation when evaluating "$hide:..." and "$baseencode:..." core: fix possible buffer overflow in command /color alias core: fix possible buffer...