The vulnerability of Azure’s Application Insights Profiler, a cloud-based tool for analyzing web application performance, stems from an incorrect path name limitation in the catalog. This allows attackers to escalate their privileges.

The vulnerability of Azure’s Application Insights Profiler, a cloud-based tool for analyzing web application performance, is related to an incorrect path name limitation. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

The vulnerability of the Python library for working with Git Dulwich repositories lies in the incorrect pathname limitation for the restricted access directory. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Python library for working with Git Dulwich repositories is related to an incorrect limitation on the path name for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

SUSE-SU-2026:22926-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

ROS-20260707-73-0024

The vulnerability of the system’s application programming interface for aggregating and storing Loki logs is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protecte...

The vulnerability of the get_abs_path() function in the framework for creating AI agents, Agent Zero, allows a hacker to read arbitrary files.

The vulnerability of the getabspath function in the framework used to create AI agents like Agent Zero is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files...

ROS-20260608-73-0015

The vulnerability of the .NET Core software platform is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability allows a remote attacker to write arbitrary files...

USN-8367-1: tar-fs vulnerabilities

It was discovered that tar-fs did not properly limit paths when extracting crafted tar files. An attacker could possibly use this issue to write or overwrite files outside the intended extraction directory. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. CVE-2024-12905 It was...

CVE-2026-43888

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndExt, a filename helper that calls path.basename on its input when truncating. When a zip entry's...

The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, allows attackers to escalate their privileges.

The vulnerability of the cluster synchronization component in Wazuh Manager, a platform for security monitoring and threat detection, is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges...

The vulnerability of the update function of the analytics and automation platform for Cisco Nexus Dashboard involves an incorrect path limitation to the catalog. This allows a malicious user to write arbitrary files into the system with root privileges.

The vulnerability of the metadata update function of the analytics and automation platform for Cisco Nexus Dashboard involves an incorrect limitation on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to write arbitrary files into the system with root privileg...

The vulnerability of the Rust programming language’s command-line interface, which allows a perpetrator to gain unauthorized access to protected information

The vulnerability of the Cygwin command-line interface in the Rust programming language is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a remote attacker to gain unauthorized access to protected information...

GHSA-775H-3XRC-C228 Parse Server has a rate limit bypass via batch request endpoint

Impact Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint /batch processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle...

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software lies in the incorrect limitation of the path name to the directory. This allows a intruder to gain unauthorized access to the protected information.

The vulnerability of TP-Link Tapo C260 IP camera’s microprogramming software is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-21878 BACnet Stack Improperly Limits Pathnames to a Restricted Directory

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.5.0.rc3, a vulnerability has been discovered in BACnet Stack's file writing functionality where there is no validation of user-provided file paths, allowing attackers to write files to arbitrary...

The vulnerability of the Music File Upload Service in D-Link DCS-700L microprogrammed software cameras allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Music File Upload Service in D-Link DCS-700L microprogrammed software cameras stems from an incorrect limit on the path to the restricted catalog during the processing of the UploadMusic parameter. Exploiting this vulnerability can allow an attacker to gain unauthorized...

The vulnerability of the moment.js agent’s RedCheck component allows a hacker to gain access to files on the server beyond the expected localization directory.

The vulnerability of the moment.js agent’s RedCheck component is related to an incorrect path limit for the access-controlled directory. Exploiting this vulnerability could allow a malicious actor to gain access to files on the server beyond the expected directory location...

MiracleLinux 4 : quagga-0.99.15-5.AXS4.2 (AXSA:2011-136:01)

The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2011-136:01 advisory. Quagga is a free software that manages TCP/IP based routing protocol. It takes multi-server and multi- thread approach to resolve the current...

The vulnerability in the application software interface of the PutContents tool, which is used for creating self-managed Git repositories like Gogs, allows a perpetrator to execute arbitrary code.

The vulnerability of the PutContents application programming interface of the Gogs self-managed Git repository creation tool is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by introduci...

The vulnerability in the web interface of the Cisco Unified Contact Center Express software solution allows a hacker to disclose protected information.

The vulnerability of the web interface of the Cisco Unified Contact Center Express Unified CCX software for automating operator operations is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability can allow a malicious actor to disclose protected...

The vulnerability of the GitHub Copilot Chat Extension for the Microsoft Visual Studio Code code editor allows a hacker to bypass existing security restrictions.

The vulnerability of the GitHub Copilot Chat Extension of the source code editor Microsoft Visual Studio Code is related to an incorrect path limitation for the directory. Exploiting this vulnerability could allow a attacker to bypass existing security restrictions...