CVE-2026-64838: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

NPM: joi: object().rename() with a template target can set the validated object's prototype

NPM: joi: object.rename with a template target can set the validated object's prototype vulnerability discovered by ? in WordPress Npm joi versions = 16.0.0, 17.13.5...

joi: object().rename() with a template target can set the validated object's prototype

Impact Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression / Joi.x target that interpolates the pattern's own match data, combined with multiple: true , for example .rename/^x-.+$/, Joi.x'1', multiple: true . Because the target is rendered...

EUVD-2026-69648

joi: object.rename with a template target can set the validated object's prototype...

GHSA-GG4H-3HG2-GRPC joi: object().rename() with a template target can set the validated object's prototype

Impact Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression / Joi.x target that interpolates the pattern's own match data, combined with multiple: true , for example .rename/^x-.+$/, Joi.x'1', multiple: true . Because the target is rendered...

OESA-2026-3599 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3598 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

OESA-2026-3597 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A TOCTOU Time-of-Chec...

Exploit for CVE-2024-21546

UniSharp Laravel Filemanager Unauthenticated RCE CVE-2024-215...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the rename method. An attacker can manipulate the prototype of the validated object by supplying specially crafted input keys that are interpreted as proto, leading to unintended property inheritance or behavior i...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the rename method. An attacker can manipulate the prototype of the validated object by supplying specially crafted input keys that are interpreted as proto, leading to unintended property inheritance or behavior i...

CVE-2026-84367

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

CVE-2026-84367

joi (a JavaScript schema validator) is vulnerable to a limited prototype pollution via object().rename() in versions 16.0.0 through 17.13.4 and 18.2.3 . The root cause lies in internals.rename() in lib/types/keys.js: when a schema uses a regular-expression source combined with a Joi.expression() ...

CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

CVE-2026-84367 joi: object().rename() with a template target can set the validated object's prototype

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

SUSE CVE-2026-72190

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix mreclock ABBA deadlock in rename ntfsfilefsync, ntfsdirfsync and ntfswriteinode lock an inode's mreclock before taking the mreclock of its parent directory. ntfsrename takes oldni-mreclock and olddirni-mreclock before...

CVE-2026-84367: Improperly Controlled Modification of Object Prototype Attributes

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename implementation used by object.rename permits a schema that renames keys with a regular-expression source and a Joi.expression or Joi.x target that...

PT-2026-84505

Name of the Vulnerable Software and Affected Versions joi versions 16.0.0 through 17.13.4 joi versions 18.0.0 through 18.2.3 Description The internals.rename implementation in lib/types/keys.js, used by object.rename, allows a schema to rename keys using a regular-expression source and a...

CVE-2026-51705

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-51705: Improper Access Control

Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi...