CVE-2026-41862 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry

Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy = v1.1202, ...

📄 Node-RED 5.0.4 Unauthenticated Denial of Service

A proof of concept exploit for an unauthenticated denial of service vulnerability in Node-RED version 5.0.4. The vulnerability is triggered by a path traversal primitive that allows a bare .. segment to reach the library save path, ultimately causing an unhandled promise rejection and process...

CVE-2026-41861 - Arbitrary Root File Write via Path Traversal in BOSH agent | Cloud Foundry

Severity Low CVSSv4: Low 2.3 CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSSv3: Medium 4.2 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Vendor CloudFoundry Foundation Versions Affected Severity is Medium unless otherwise noted. BOSH – All bosh agent versions v2.847.0 jammy =...

Google Chrome < 151.0.7922.108 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 151.0.7922.108. It is, therefore, affected by multiple vulnerabilities as referenced in the 202608stable-channel-update-for-desktop01193673229 advisory. - Use after free in Skia. CVE-2026-19154, CVE-2026-19176 - Use after...

SUSE SLES12 Security Update : pcp (SUSE-SU-2026:3508-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3508-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalati...

The vulnerability of the kfd_event_page_set() function in the drivers/gpu/drm/amd/amdkfd/kfd_events.c module of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the kfdeventpageset function in the drivers/gpu/drm/amd/amdkfd/kfdevents.c module of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to out-of-buffer writing. Exploiting this vulnerability could allow an attacker to...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3505-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3505-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot...

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

GHSA-CF44-9PGV-M4XC rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Summary With -l/--links, rclone serializes symlinks as .rclonelink text objects whose body is the link target. When rclone writes such an object to a local destination, it recreates the symlink with os.Symlink, and performs NO validation of the target. If the source is attacker-controlled, the...

CVE-2026-18954

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

CVE-2026-18954

CVE-2026-18954 : Affected product is Amazon AWS Labs DocumentDB MCP Server prior to 1.0.12. The issue is incorrect authorization in the aggregation pipeline tool that could allow a authenticated MCP client to perform write operations via write-capable aggregation pipeline stages, bypassing the re...

CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-66881 Path traversal in imported file_entries name allows arbitrary file write via URL-type entry download

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

CVE-2026-66881

CVE-2026-66881 affects Livebook: path traversal via URL-type file entries allows an attacker-authored notebook to cause arbitrary file writes controlled by the attacker. The root cause is that Livebook resolves the entry name beneath the session temp directory without enforcing containment, and f...

CVE-2026-66881

Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled content to an arbitrary path. A .livemd notebook can declare fileentries metadata, each entry carrying a name. Every path that creates a file entry through...

EUVD-2026-53583

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-18953 Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...