149131 matches found
Exploit for Path Traversal in Grafana
\ Replication of Lab and Security Analysis: CVE-2021-43798...
CVE-2026-101044
A flaw was found in pnpm. The package manager does not properly sanitize dependency names and alias paths specified within project lockfiles. By convincing a user or build system to install a project containing a crafted lockfile, an attacker can exploit this path traversal issue to create...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051
Cloudreve versions prior to 4.16.1 are vulnerable to a path traversal flaw during remote downloads. The application fails to properly sanitize file paths returned by remote downloaders, which allows authenticated users to exploit path traversal sequences in downloader metadata. This enables an at...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
EUVD-2026-87980
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
EUVD-2026-87975
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CVE-2026-101044
The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and
CVE-2026-101044
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
Eleveo Quality Management path traversal vulnerability
Eleveo Quality Management version 9.7.0 has a path traversal vulnerability. This vulnerability stems from the improper handling of the file Scorecard.jsp in the Questionnaire Audio Upload component, which may lead to path traversal attacks...
CLSA-2026-1790520007 TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.10-tuxcare.1...
Exploit for Path Traversal in Jenkins
\ CVE-2024-23897 — Jenkins CLI Arbitrary File Read Lab \ 1...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
Exploit for CVE-2026-87902
CVE-2026-87902 — WordPress Core Unauthenticated Local File Inc...
CVE-2026-97164
The Event Gallery extension for Joomla (developed by svenbluege.de ) versions
EUVD-2026-87931
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...