Linux Distros Unpatched Vulnerability : CVE-2026-93325

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under...

CVE-2026-119673 mongofiles may write outside the working directory through a symlink

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

Malicious code in @goparrot-dashboard/homepages (npm)

@goparrot-dashboard/homepages is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

MAL-2026-18499 Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...

CVE-2024-21626

CVE-2024-21626 Exploit Working Directory docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Important is to put -w /proc/self/fd/8\ Access the host filesystem using cat ../../../../../../../../../etc/passwd inside the container Exploit Symlink 1. docker run --name...

CVE-2024-21626

CVE-2024-21626 For detailed explanation for this vulnerability, plz refer to my article. Exploit Exploit via Running a Container No need to build a custom image, just run a container with -w parameter: docker run -w /proc/self/fd/8 --name cve-2024-21626 --rm -it debian:bookworm Exploit via Execin...

CVE-2024-21626

about Steps to reproduce ensure kernal = 5.4,4.19,.. and there is openat2 in /proc/kallsyms. v1.0.0-rc93= runc =1.1.11 $ grep openat2 /proc/kallsyms ffffffffa64290d0 T pfxauditopenat2how ffffffffa64290e0 T auditopenat2how ffffffffa666de90 t pfxdosysopenat2 ffffffffa666dea0 t dosysopenat2...

CVE-2025-56383

Vulnerability Attack Type: DLL Hijacking DLL Hijacking Target Application: Notepad++ Method: The NppExport.dll file is loaded by Notepad++ from the working directory Implementation The malicious DLL contains: Exported functions of the original library to ensure compatibility Reverse shell...

CVE-2024-21262

RECORDS Only for reproduction of CVEs. Related Resources: LINK GITHUB1 GITHUB2 ISSUE Check Envs Download docker-24.0.6.tgz from https://download.docker.com/linux/static/stable/x8664/. sudo mkdir -p /usr/local/docker-24.0.6 sudo tar -xzf docker-24.0.6.tgz -C /usr/local/docker-24.0.6 sudo ln -sf...

MAL-2026-18319 Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Astra Linux – vulnerability in jupyter-core

Jupyter Core is a package providing the core common functionality for Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupytercore, which arises because jupytercore executes untrusted files in CWD. This vulnerability enables one user to...

Astra Linux – vulnerability in Perl

Perl threads suffer from a working directory race condition, where file operations may target unintended paths. If a directory handle is opened at thread creation, the process-wide current working directory is temporarily changed to clone that handle for the new thread; this change is visible to...

CVE-2026-86826

The BackWPup WordPress plugin, in versions before 5.7.7 , fails to properly restrict web access to the working directory utilized during backup restores. On webservers that do not honor .htaccess rules, such as NGINX , unauthenticated attackers can download full backup archives left behind by int...

CVE-2026-86826 BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive database dump and site...

CVE-2026-102262

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

PT-2026-106228

Name of the Vulnerable Software and Affected Versions Newell Brands DYMO ID versions prior to 1.6.0 Description The software resolves its plugin Modules directory relative to the process working directory. This allows an attacker to store a job file alongside malicious modules or DLLs. When a...

Rocky Linux 10.0 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2025_12056)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512056 advisory. perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-40909 Tenable has extracted the preceding...