CVE-2026-82111 iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component uploadimage. Performing a manipulation of the argument imagepath results in path traversal. The attack can be initiated remotely. The...

CVE-2026-82111 iswalle getnote-mcp upload_image index.ts fs.readFileSync path traversal

A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component uploadimage. Performing a manipulation of the argument imagepath results in path traversal. The attack can be initiated remotely. The...

CVE-2026-82111

iswalle getnote-mcp (up to version 1.5.0 ) is affected by a path traversal vulnerability in the upload_image component. The affected element is the fs.readFileSync function in src/index.ts, where manipulation of the image_path argument allows an attacker to read files outside the intended directo...

CVE-2026-75143

A flaw was found in FFmpeg. A heap buffer overflow in the RIST protocol reader allows a remote attacker to trigger memory corruption by sending an oversized packet to an FFmpeg instance receiving a RIST stream. The libristread function ignores its buffer size argument, copying the full payload in...

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

EUVD-2026-67585

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

CVE-2026-82259

SvelteKit versions 2.49.0 through 2.53.2 (fixed in 2.53.3 ) are affected by a deserialization expansion vulnerability in the experimental form remote function . When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files....

CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

SvelteKit versions from 2.49.0 through 2.53.2 fixed in 2.53.3 contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or...

EUVD-2026-67582

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256

SvelteKit versions prior to 2.69.1 contain a denial-of-service vulnerability in its remote form function handling. The root cause is a failure to properly validate payload sizes, allowing an unauthenticated network attacker to crash the Node process by sending abnormally large payloads. Repeated ...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process...

CVE-2026-82253 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82253

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

EUVD-2026-67705

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82253 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82253 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass

gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.findb"..", allowing crafted names such as 'a..b/../../../.git/' to bypass the check;...

CVE-2026-82253

gitoxide (Rust crates gix ≤ 0.72.0 and gix-validate ≤ 0.10.0 ) is affected by a path traversal vulnerability. The submodule name validation in gix-validate only checks the first occurrence of .. via name.find(b".."), allowing crafted names like a..b/../../../.git/ to bypass the check. Additionall...