CVE-2019-25281 NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths

NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code that...

CVE-2019-25281

CVE-2019-25281 concerns NCP Secure Entry Client 9.2. The issue is an unquoted service path vulnerability in multiple Windows services (e.g., ncprwsnt, rwsrsu, ncpclcfg, NcpSec) that can be exploited to inject and execute code with LocalSystem privileges during service startup. Exploitation is des...

EUVD-2026-5331

SiYuan is a personal knowledge management system. Prior to version 3.5.5, the /api/file/copyFile endpoint does not validate the dest parameter, allowing authenticated users to write files to arbitrary locations on the filesystem. This can lead to Remote Code Execution RCE by writing to sensitive...

CVE-2026-25475

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...

CVE-2026-25475

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...

CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction

OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/fil...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied path components in file operation handlers. An attacker can gain unauthorized access to, modify, or delete files belonging to other users by injecting traversal sequences into...

CVE-2026-23079

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: Fix resource leaks on errors in lineinfochangednotify On error handling paths, lineinfochangednotify doesn't free the allocated resources which results leaks. Fix it...

CVE-2026-23091 intel_th: fix device leak on output open()

In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the th device during output device open on errors and on close. Note that a recent commit fixed the leak in a couple of open error path...

CVE-2026-23091

CVE-2026-23091 concerns the Linux kernel intel_th subsystem, where a device-leak was reported during output open(). The description states to drop the reference taken when looking up the th device on errors and on close(). It notes that a recent commit fixed the leak in some open() error paths bu...

CVE-2026-23091

In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the th device during output device open on errors and on close. Note that a recent commit fixed the leak in a couple of open error path...

CVE-2026-23091 intel_th: fix device leak on output open()

In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the th device during output device open on errors and on close. Note that a recent commit fixed the leak in a couple of open error path...

PT-2026-5810

Name of the Vulnerable Software and Affected Versions NCP Secure Entry Client version 9.2 Description NCP Secure Entry Client 9.2 contains a flaw due to unquoted service paths in multiple Windows services. This allows local users to potentially execute arbitrary code. Specifically, attackers can...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from double deallocation in incorrect paths, potentially leading to memory corruption...

PT-2026-6473

Summary The isValidMedia function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. Detai...

Autodesk 3ds Max 代码问题漏洞

Autodesk 3ds Max is a full-featured 3D computer graphics software developed by Autodesk, Inc. There are code vulnerabilities in Autodesk 3ds Max. These vulnerabilities stem from the use of untrusted search paths when opening max files, which may lead to the execution of arbitrary code...

CVE-2026-24512 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note tha...

CVE-2026-24512 ingress-nginx auth-method nginx configuration injection

A security issue was discovered in ingress-nginx where the rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note tha...

Linux Distros Unpatched Vulnerability : CVE-2026-22444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The create core API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of a...

PT-2026-6334

Name of the Vulnerable Software and Affected Versions BrowserStack Runner versions 0.1.0 through 0.9.5 Notepad++ versions prior to 8.8.2 Description BrowserStack Runner contains a path traversal issue in the default HTTP handler within lib/server.js. This allows unauthenticated network-adjacent...