CVE-2026-34990-poc

CVE-2026-34990 CUPS 2.4.16 local privilege escalation via arbitrary file write through CUPSCREATELOCALPRINTER. Vulnerability CUPS allows creating local printers with a device-uri set to a file:// path. Submitting a print job with document-format: application/vnd.cups-raw and compression: gzip...

CVE-2026-34990-CUPS-LPE-PoC

CVE-2026-34990 | CUPS Local Privilege Escalation PoC A generic proof-of-concept for CVE-2026-34990 , a local privilege escalation vulnerability affecting CUPS 2.4.16. The exploit demonstrates how a local unprivileged user can abuse CUPS local authentication and printer configuration behavior to...

cups-2.4.16-lpe

CUPS 2.4.16 — Local Privilege Escalation CVE-2026-34990 📋 Summary CUPS 2.4.16 contains a local privilege escalation vulnerability also tracked as GHSA-c54j-2vqw-wpwp. The Vulnerability 1. World-writable socket — /run/cups/cups.sock is world-writable, allowing any local user to send IPP requests t...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

rsync: rsync: Information disclosure and denial of service via crafted files-from entry

A flaw was found in rsync. Remote unauthenticated attackers can exploit a heap out-of-bounds write vulnerability by supplying a crafted files-from entry. This entry, containing both an interior and trailing backslash, causes the addimpliedinclude function to under-count the trailing backslash whe...

rsync: rsync: Arbitrary file write via path traversal in --relative mode

A path traversal vulnerability in rsync's --relative mode allows a malicious sender to craft symlink paths, enabling arbitrary file writes outside the destination directory...

rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...

Important: Red Hat Security Advisory: rsync security, bug fix, and enhancement update

An update for rsync is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options

A flaw was found in rsync. A remote attacker can exploit this vulnerability by specifying an absolute path using the --temp-dir or --link-dest options. This bypasses the rename-confinement logic, allowing the attacker to write files to arbitrary locations outside the intended destination tree,...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

rsync: rsync: Memory corruption via crafted file entries

A flaw was found in rsync. This out-of-bounds write vulnerability allows attackers to corrupt memory by triggering specific processing on specially crafted file entries when hard-link preservation is not active. This can lead to denial of service or other unpredictable system behavior...

rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

A flaw was found in rsync. This vulnerability allows remote clients to bypass path confinement, a security measure designed to restrict file access. By crafting specific paths that include a '/./' boundary marker within a chroot environment, an attacker can gain unauthorized read or write access ...

CVE-2026-51864

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-51862

DB-GPT 0.8.0 contains directory traversal in skillupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py:40. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-102146

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-102143

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...

CVE-2026-102131

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they could be supplied. An authenticated administrator could potentially use an unrecognized form to have a file of their choosing written to the gateway and...

CVE-2026-102123

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

CVE-2026-102116

-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended location and cause the application to execute it, potentially resulting in remote code execution as the underlying service account...