109097 matches found
CVE-2026-67245
CVE-2026-67245 describes a path traversal in the ADM VPN Clients caused by insufficient validation of user-controlled certificate name when building the upload destination path. An authenticated attacker could write an uploaded certificate file outside the intended VPN certificate directory, cons...
CVE-2025-69934
The CVE-2025-69934 entry concerns CodeAstro Membership Management System 1.0 and has a concrete flaw: SQL Injection in /delete_members.php?id=1. The issue is tied to the delete_members.php parameter handling, with CVSS 3.1 metrics showing a Network attack vector, no privileges required, no user i...
PT-2026-66542
Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.3 Description Banks parses Tool JSON objects from the rendered body of % completion % blocks and resolves the import path field using importlib.import module... and getattr... to identify the callable for tool calls...
PT-2026-66517
Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...
CVE-2025-69931
CVE-2025-69931 affects CodeAstro Membership Management System 1.0. A SQL Injection vulnerability is exposed in the endpoint /delete_membership.php?id=1, enabling an attacker to potentially manipulate the database. The CVSS v3.1 base score is 9.8 (CRITICAL), with impact on confidentiality, integri...
Siemens Teamcenter Visualization 2412.x < 2412.0012 / 2506.x < 2506.0009 / 2512.x < 2512.2605 Privilege Escalation (SSA-288252)
The version of Siemens Teamcenter Visualization installed on the remote host is 2412.x prior to 2412.0012, 2506.x prior to 2506.0009, or 2512.x prior to 2512.2605. It is, therefore, affected by a vulnerability: - Untrusted search path in IAM Client SDK may allow an authenticated user to potential...
EUVD-2025-210559
code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...
Linux Distros Unpatched Vulnerability : CVE-2026-16531
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary...
RockyLinux 8 : openssh (RLSA-2026:47755)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:47755 advisory. openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux OpenSSH client versions CVE-2026-55655 openssh: Double free in...
B&R Automation X20EDS410 Write-what-where Condition (CVE-2026-43284)
The Linux kernel version shipped with the affected B&R product X20EDS410 is affected by a vulnerability. A flaw in the kernel's xfrm ESP input path that decrypts in place over shared skb frags. Successful local exploitation of this vulnerability could allow an authenticated attacker with low...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 — Apache HTTP Server 2.4.49 Path Traversal & RC...
CVE-2026-67433
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename and allowed a local user controlling the plugin account to place a...
CVE-2026-5489
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...
CVE-2026-5487
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...
EUVD-2026-50492
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service,...
CVE-2026-13346 pip absolute path traversal during download from malicious package indexes
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...
CVE-2026-13346
Pip has a vulnerability (CVE-2026-13346) where doubly-encoded package URLs from indexes can lead to files being installed to arbitrary locations on disk, even when installing wheels. The issue is exploitable only when downloading/installing from a malicious package index; malicious packages alone...
CVE-2026-64312
A flaw was found in the Linux kernel's parallel cryptography pcrypt subsystem. When the system falls back to a non-parallel processing path, it fails to properly restore the original callback function and data. This oversight can lead to an asynchronous completion running an incorrect callback,...
CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive
proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...