147942 matches found
CVE-2026-101295
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
EUVD-2026-89959
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-101295
The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...
CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
OESA-2026-4183 python-pymdown-extensions security update
Extension pack for Python Markdown. Security Fixes: PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when...
OESA-2026-4184 python-pymdown-extensions security update
Extension pack for Python Markdown. Security Fixes: PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when...
OESA-2026-4182 python-pymdown-extensions security update
Extension pack for Python Markdown. Security Fixes: PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when...
OESA-2026-4165 python-jupyter-server security update
The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...
OESA-2026-4164 python-jupyter-server security update
The backend for Jupyter web applications Security Fixes: Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe, which allows redirects to arbitra...
CVE-2026-101295
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...
CVE-2026-97244
Contributor Path Traversal in Creator LMS = 1.2.19 versions...
CVE-2026-97244
The Creator LMS WordPress plugin (versions
CVE-2026-97244 WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
Contributor Path Traversal in Creator LMS = 1.2.19 versions...
CVE-2026-97244 WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability
Contributor Path Traversal in Creator LMS = 1.2.19 versions...
EUVD-2026-89908
Contributor Path Traversal in Creator LMS = 1.2.19 versions...
CVE-2026-10726
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...
CVE-2026-87830
In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommend...
CVE-2026-10726
The Cato Windows SDP Client before version 6.12.6 is vulnerable to an arbitrary file disclosure vulnerability. A low-privileged local user can exploit this flaw to force the Windows service—which operates with Local System privileges—to read and disclose arbitrary local files. The root cause is a...
EUVD-2026-89780
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...