CVE-2026-55495 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

CVE-2026-55495

Summary: Cloudreve up to v4.16.x is vulnerable to a path traversal via the WOPI PUT_RELATIVE handler. The WOPI header X-WOPI-SuggestedTarget is treated as a path and joined to the source directory using URI.JoinRaw, allowing slashes and dot-dot segments to escape the source file directory and cre...

EUVD-2026-51336

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet...

EUVD-2026-51330

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

JFrog Artifactory < 7.111.18 / 7.117.x < 7.117.25 / 7.125.x < 7.125.18 / 7.133.x < 7.133.27 / 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and...

Adobe Bridge < 15.1.7 / 16.x < 16.0.6 Multiple Vulnerabilities (APSB26-89)

The version of Adobe Bridge installed on the remote Windows host is prior to 15.1.7 or 16.0.6. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-89 advisory. - Bridge is affected by an Untrusted Search Path vulnerability that could result in arbitrary code executi...

PT-2026-66678

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description An unauthenticated remote attacker can read image-decodable files and enumerate host paths. The get model preview function in app/model manager.py uses os.path.joinfolder, filename with an...

RHCOS 4 : OpenShift Container Platform 4.15.67 (RHSA-2026:43225)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:43225 advisory. - google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation...

Qnap QTS and QuTS hero Path Traversal (CVE-2026-24717)

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...

PT-2026-66847

Name of the Vulnerable Software and Affected Versions Contao versions 5.7.0 through 5.7.6 Description An authenticated backend user with access to a specific job can perform a cross-job authorization bypass. By requesting an attachment identifier containing ../ segments, the user can force the jo...

Oracle Linux 9 : kernel (ELSA-2026-45192)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45192 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213468 CVE-2026-63807 - KVM: x86: Don't recheck L1...

Erlang/OTP 26.2 < 27.3.4.15 / 28.0 < 28.5.0.4 / 29.0 < 29.0.4 Policy Tree DoS (CVE-2026-59251)

The version of Erlang/OTP installed on the remote host is 26.2 prior to 27.3.4.15, 28.0 prior to 28.5.0.4, or 29.0 prior to 29.0.4. It is, therefore, affected by a vulnerability: - Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote...

CVE-2026-64816

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...

CVE-2025-65342

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...

DEBIAN-CVE-2026-66755

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their...

UBUNTU-CVE-2026-66756

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1, which fixes the issue...