109593 matches found
CVE-2026-51134
The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...
AlmaLinux 9 : rsync (ALSA-2026:67462)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67462 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...
PT-2026-91861
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...
Linux Distros Unpatched Vulnerability : CVE-2026-82049
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link...
AlmaLinux 10 : rsync (ALSA-2026:67463)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67463 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...
PT-2026-91772
Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directo...
RockyLinux 10 : rsync (RLSA-2026:67463)
The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67463 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...
EUVD-2026-79997
The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...
CVE-2026-91200
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...
CVE-2026-91144
ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...
CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...
CVE-2026-91200
DevSpace versions through 6.3.21 contain a path traversal vulnerability in the in-pod sync stream's tar extraction logic. The tool fails to reject parent-directory segments in tar entry names, allowing an attacker operating a malicious container to stream tar entries with traversal sequences that...
CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...
CVE-2026-77262
CVE-2026-77262 — mcp-atlassian の confluenceuploadattachment における任意ファイル読み取り 深刻度 : 高 CVSS 8.6 CWE : CWE-22 — パストラバーサル 影響を受けるバージョン : sooperset/mcp-atlassian 0.22.0 修正バージョン : 0.22.0 アドバイザリ : GHSA-p6hp-93wp-fh6p NVD : https://nvd.nist.gov/vuln/detail/CVE-2026-77262 報告者 : Romain Deperne TL;DR...
CVE-2026-28995
CVE-2026-28995 CVE-2026-28995の概念実証 — iOS 26.4.2以下におけるApp Intentsのパストラバーサル脆弱性。 説明 この脆弱性により、悪意のあるアプリがApp Intentsを介してサンドボックス外の任意のファイルを読み取ることができます。根本原因は、AppleのApp Intentsフレームワークにおける不十分なパス検証です。 影響を受けるバージョン: iOS 26.4.2以下 修正バージョン: iOS 26.5 2026年5月11日 使用方法 1. 関数 readCvepath: String - String root@kitploit...
Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.
Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...
CVE-2026-86886
A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...
CVE-2026-84598
A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...
CVE-2026-84568
A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...