CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

EUVD-2026-76150

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

CVE-2026-89257

AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce but omits the Category::userCanEditCategory() ownership check enforced by the s...

CVE-2026-89065: Relative Path Traversal

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...

PT-2026-89860

AVideo through 29.0 contains an insecure direct object reference IDOR vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory capability and a CSRF nonce before passing the attacker-supplied $ REQUEST'id' to Category::deleteAssets, which...

CVE-2026-78622

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

CVE-2026-78622 Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

EUVD-2026-74184

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

CVE-2026-78622 Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

CVE-2026-78622: Improper Link Resolution Before File Access

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

PT-2026-88433

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

CVE-2026-85781

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781

The Amazon EFS CSI Driver (kubernetes-sigs/aws-efs-csi-driver) before v3.4.1 is vulnerable to unverified ownership of a storage access point in its volume deletion component. An authenticated Kubernetes user with PersistentVolume creation privileges can craft a PersistentVolume volumeHandle that ...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

EUVD-2026-71692

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781 Unverified access point ownership in Amazon EFS CSI Driver

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...

CVE-2026-85781: Unverified Ownership

Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an authenticated Kubernetes user with PersistentVolume creation privileges to cause recursive deletion of directories on an EFS filesystem they are not authorized...