PT-2026-107395

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

PT-2026-107433

Path traversal of 'trusted jar paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted jar paths'. The startup flag 'trusted jar paths' references URIs for loading files from local or remote filesystems. Path...

Linux Distros Unpatched Vulnerability : CVE-2026-105840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files...

CVE-2026-103360 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-69328

StorSvc loads SprintCSP.dll by relative name as SYSTEM. Plant it in a user-writable HKLM PATH directory, get SYSTEM. Requires a user-writable directory in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path. None on a clean image. Tooling installers add them...

CVE-2021-43798

uso: grafana-exploit.py -h -H/--host HOST grafana-exploit.py: error: los siguientes argumentos son requeridos: -H/--host ejemplo: python3 grafana-exploit.py --host si se lee exitosamente un archivo arbitrario muestra la URL de la solicitud y el comando curl +RequestURL...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal non autenticato nella risoluzione dei template di pagina Inclusione locale non autenticata di file PHP in WordPress Core tramite un valore pagename con doppia codifica — e, in specifiche condizioni di deployment, esecuzione di codice PHP con i...

CVE-2026-106186

An uncontrolled search path element flaw was found in the CredentialProvider component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/522557469...

CodePath_Week_7-8

CodePath Semana 7-8 Tarea de CodePath para las Semanas 7 y 8: CVE-2017-14719, CVE-2019-9787 y Modificación no autenticada del contenido de Páginas/Entradas vía REST API Proyecto 7 - Pentesting de WordPress Tiempo dedicado: 16 horas en total Objetivo: Encontrar, analizar, recrear y documentar...

CVE-2026-106493

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106491

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106486

Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

EUVD-2026-94051

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684 Gitea push mirror local path check uses the repository owner

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

CVE-2026-86684

An improper authorization check in the Gitea push mirror API allows an authenticated repository administrator to bypass local file system access restrictions. When the [security] IMPORT_LOCAL_PATHS = true setting is enabled, an administrator who lacks permission to import local paths can configur...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106493 Backstage: Cloud storage catalog locations may cross configured storage boundaries

Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalog providers did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to b...

CVE-2026-106491 Backstage: Improper input validation in proxy-backend

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

CVE-2026-106491

The Backstage framework, an open framework for building developer portals, is vulnerable to improper input validation within the @backstage/plugin-proxy-backend package in versions prior to 0.6.17 . An authenticated user can craft a request URL that forces the proxy-backend to forward requests to...