70930 matches found
CVE-2026-102424
The Joomla Extension - balbooa.com component, specifically Balbooa Forms versions
CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...
EUVD-2026-89098
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...
CVE-2026-101126
The Joomla Extension - balbooa.com is vulnerable to file metadata tampering in Balbooa Forms versions prior to 2.4.3.4 . The root cause is that the final form submission processes JSON arrays for upload fields while only verifying that IDs are numeric. Because the application trusts client-suppli...
CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.4
Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...
EUVD-2026-64850
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath...
GHSA-G84C-RXFJ-3J2C webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
NPM: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath vulnerability discovered by ? in WordPress Npm webpack-dev-middleware versions 7.4.5...
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath
!IMPORTANT CVE-2026-76844 was assigned and published for this issue by VulnCheck on 2026-08-24 without prior coordination with the webpack maintainers or the OpenJS Foundation, which holds the CVE Numbering Authority scope for webpack projects. Neither the maintainers nor the OpenJS CNA were...
CVE-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
CVE-2026-90915
Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 are vulnerable to arbitrary directory deletion . The root cause is an improper validation of the cache group name, which allows path traversals within the file storage of the caching layer during a cache purge action. This flaw can be exploited to...
EUVD-2026-89088
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
CVE-2026-90915 Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...
DEBIAN-CVE-2026-102601
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls pregmatch with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes...
CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...
CVE-2026-19743
The TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 are vulnerable to a Path Traversal flaw in the local IPC service. Due to improper path validation, a local authenticated user with low privileges can send crafted IPC commands to the service daemon to manipula...
CVE-2026-19743 Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges NT AUTHORITY/SYSTEM \ root. By sending crafted I...
OPENSUSE-SU-2026:21970-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...
SUSE-SU-2026:23943-1 Security update for php-composer2
This update for php-composer2 fixes the following issues: - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898...
