CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

EUVD-2026-93424

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-105795 Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

DEBIAN-CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

AZL-106667 CVE-2026-105840 affecting package lrzsz 0.12.20-50

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-43637-cornac

CVE-2026-43637 : Traversée de chemin Tar Slip dans Cornac via extractarchive Sévérité : Élevée, CVSS 4.0 8.8 , Critique, CVSS 3.1 9.1 attribué par VulnCheck, la CNA Vecteur v4.0 : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vecteur v4.0 :...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

EUVD-2026-93392

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105840

The lrzsz utility, in versions before 0.13.0 , is vulnerable to a path traversal issue within the lrz receive utility's restricted mode. The root cause is located in src/lrz.c, where the checkpath() function fails to reject absolute pathnames unless the software is specifically built with --enabl...

CVE-2026-105840 lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-105834

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

Mitigation-Apache-CVE-2021-41773-

Mitigation-CVE-2021-41773- سكربت شل للتخفيف من CVE-2021-41773 ثغرة اجتياز المسار وكشف الملفات في Apache التثبيت wget https://github.com/EkamSinghWalia/Mitigation-CVE-2021-41773-.git الاستخدام إصلاح كامل وطريقة مقترحة للتخفيف من الثغرة سيقوم هذا السكربت بترقية وتحديث مستودع النظام وأباتشي bash...

CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

CVE-2026-105834

Rundeck versions before 6.2.0 are vulnerable to a path traversal vulnerability in the File Resource Model Source . This flaw allows users with only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to an absolute path. Attackers can exploit this vi...

CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

CVE-2026-105834 Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

EUVD-2026-93378

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

[SECURITY] [DLA 4825-1] suricata-update security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4825-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 06, 2026 https://wiki.debian.org/LTS -...

CVE-2020-14882-WebLogic-Analysis

Recherche de vulnérabilités : Exploitation de la chaîne CVE-2020-14882 et CVE-2020-14883 dans Oracle WebLogic Server Le dépôt contient un rapport technique Write-up et une preuve de concept PoC pour démontrer la chaîne de vulnérabilités de contournement d'authentification Authentication Bypass et...