34891 matches found
Exploit for CVE-2026-66066
CVE-2026-66066 — KindaRails2Shell Rails Active Storage/libvips A...
CVE-2026-56845
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
CVE-2026-56845
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
EUVD-2026-52560
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
CVE-2026-56845
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
CVE-2026-56845
The CVE describes an unauthenticated Local File Inclusion (LFI) vulnerability under /custom-sounds/ when CustomSounds storage uses FileSystem. An attacker can use ../ sequences in the request path to read arbitrary files outside the base directory. Documented impact is reading sensitive files; no...
CVE-2026-67979
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...
PT-2026-93233
TuxCare rebuilt google-cloud-storage to address 1 CVE. Fixed in 2.19.0.post2+tuxcare...
PT-2026-67829
Name of the Vulnerable Software and Affected Versions CVAT versions 1.6.0 through 2.64.0 Description An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server's filesystem. Recommendations Updat...
CVE-2026-67979
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...
CVE-2026-67979
NASA cFS v7.0.1 is vulnerable to incorrect access control within the Executive Services dynamic application start path component. This security flaw allows an attacker to achieve arbitrary code execution by placing a shared object on the target storage. No specific exploit links or remediation in...
CVE-2026-15721: Cleartext Storage of Sensitive Information
Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
PT-2026-68999
These are all security issues fixed in the azure-storage-azcopy-10.32.6-1.1 package on the GA media of openSUSE Tumbleweed...
EUVD-2026-52972
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...
CVE-2026-47682: Improper Limitation of a Pathname to a Restricted Directory
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...
PT-2026-67921
Summary An authenticated user whose features.image generation permission has been revoked can still make the server generate images by sending the feature flag in a chat-completion request. The chat pipeline took the client-supplied features object at face value and never re-checked the permissio...
PT-2026-67573
An unauthenticated path traversal LFI vulnerability exists under /custom-sounds/ when CustomSounds storage is configured to FileSystem. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory...
CVE-2026-67979
Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...
PT-2026-67686
Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
