PyTorch TorchServe SSRF

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

EUVD-2023-60632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22631: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

PT-2026-91036

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2023-22631

CVE-2023-22631 affects PRTG Network Monitor versions before 23.1.82 , allowing a remote attacker with high privileges to write to files via the HTTP XML/REST Sensor , resulting in a low integrity impact (CVSS 3.1: 2.7 LOW , AV:N/AC:L/PR:H). The Dutch NCSC advisory notes that an authenticated mali...

CVE-2023-22632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

AZL-99972 CVE-2026-78254 affecting package ant for versions less than 1.10.18-1

The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker's choice using the permissions of the...

CVE-2026-73102 RustDesk Path Traversal via macOS Clipboard File-Paste

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. The application accepts peer-supplied file descriptor names and joins them to the selected target directory without requiring normalized relative paths. A remote peer in an...

SUSE SLED15 / SLES15 Security Update : open-iscsi (SUSE-SU-2026:3647-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3647-1 advisory. - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socke...

CVE-2026-49253 electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile joins the filename to the...

Security update for open-iscsi

This update for open-iscsi fixes the following issues: CVE-2026-44943: remote file-write as root via discovery bsc1268353. CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

SUSE-SU-2026:3647-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socket auth bypass bsc1268352. Changes for open-iscsi: - Update to version 2.1.12.suse+0.8f77cf16: Preparing for version 2.1.12 536...

CVE-2026-17181

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal...

CVE-2026-17081 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory...

EUVD-2026-54235

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-15435 IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to write arbitrary files on the system...

Security Bulletin: IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability (CVE-2026-15435)

Summary IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability. Vulnerability Details CVEID:CVE-2026-15435 DESCRIPTION: IBM App Connect Enterprise could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request...

CVE-2026-44943 remote limited file-write as root via discovery in open-iscsi

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

Python Library yt-dlp < 2026.6.9 Multiple Vulnerabilities

The detected version of the yt-dlp Python package is prior to 2026.6.9. It is, therefore, affected by multiple vulnerabilities: - A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files such as .desktop, .url, .webloc to the user's filesystem, bypassing...