CVE-2026-105293

Legcord versions 1.1.0 through 1.3.0 are vulnerable to a path traversal vulnerability within the theme IPC handlers. The root cause is the use of unvalidated theme ids , which allows scripts running in the Discord origin (e.g., via XSS ) to escape the designated themes directory. Attackers can ab...

EUVD-2026-92157

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105293 Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

EUVD-2026-92135

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

EUVD-2026-92134

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-105174 Gerapy Project Management views.py project_create path traversal

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

EUVD-2026-92154

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105174

A path traversal vulnerability exists in Gerapy up to version 0.9.13 within the Project Management component. The issue is located in the project_create function of the gerapy/server/core/views.py file, where improper handling of the project_name argument allows for unauthorized directory access....

CVE-2026-105174 Gerapy Project Management views.py project_create path traversal

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105174 Gerapy Project Management views.py project_create path traversal

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

PT-2026-104818

Name of the Vulnerable Software and Affected Versions LibreOffice Calc versions prior to 26.2.5 Description LibreOffice Calc allows linking a cell range to an external data source, with the link saved within the document. An attacker can specify a Java database driver to be loaded from a remote...

CVE-2026-78413: Incorrect Default Permissions

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch...

CVE-2026-105293: Improper Limitation of a Pathname to a Restricted Directory

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall...

CVE-2026-105223: Improper Certificate Validation

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105174: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function projectcreate of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument projectname leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105286: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

CVE-2026-104810: Path Traversal: 'dir\..\..\filename'

This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management →...

CVE-2026-104806: Path Traversal: 'dir\..\..\filename'

DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to...