CVE-2026-112946

A flaw was found in Vite. On network-accessible development servers, improper path resolution during import analysis can cause root-relative paths to be incorrectly marked as safe module paths. An unauthenticated remote attacker can exploit this issue by requesting specially crafted paths that...

CVE-2026-95168

A flaw was found in thefuck. This vulnerability allows a local attacker to execute arbitrary code by supplying malicious rule files through insecure import path resolution. When the application loads rules, it evaluates code from untrusted paths, leading to unauthorized code execution with the...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CLSA-2026-1791908277 rsync: Fix of CVE-2026-43619

CVE-2026-29518: re-implement the "use chroot = no" confinement after the centos7els fix: every path operation proves its parent directory beneath the pinned module root through /proc/self/fd and runs on it with the at calls. In-module symlinks, directories the daemon uid may search but not read,...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ksmbd: Fixed path resolution in ksmbdvfskernpathcreate. The SMB2 open lookup is rooted at the share using LOOKUPBENEATH, but the create/mkdir/hardlink logic does not use this approach. ksmbdvfskernpathcreate generates an...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CLEANSTART-2026-YF83540 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CVE-2026-110852

The n8n workflow automation tool versions prior to 1.123.83 , 2.x before 2.41.4 , and 2.42.x before 2.42.1 are vulnerable to an authentication bypass (CWE-288). The root cause is that dynamic-path webhook resolution matches requests based solely on the path, failing to validate the server-generat...

Unity Linux 20.1070a Security Update: grafana (UTSA-2026-130158)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130158 advisory. Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic...

Debian: CVE-2026-53613: util-linux -- security update

util-linux is a random collection of Linux utilities. In util-linux 2.17 through 2.41.6 and 2.42 through 2.42.3, and in 2.42.4 when the legacy mount2 path is used without /proc, restricted non-root mount requests validate an /etc/fstab target before the mount operation re-resolves that pathname. ...

TencentOS Server 3: git-lfs (TSSA-2026:1134)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1134 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

CLEANSTART-2026-ID47873 Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution

Security vulnerability affects the apache-nifi package. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution...

PT-2026-117775

Security vulnerability affects the apache-nifi package. Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution...

AlmaLinux 9.2 [TuxCare] Security Update: runc (ALMALINUX9.2:CLSA-2026:1791543621)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791543621 advisory. - Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each ste...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-95106: Use of Incorrectly-Resolved Name or Reference

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff...