CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-12553

HP Web Jetadmin (WJA) is vulnerable to DLL hijacking, allowing unauthenticated remote attackers to read or write arbitrary files. CVSS 4.0 scores this CRITICAL (9.3) with network access, low complexity, and no privileges required. Exploitation is rated PROOF-OF-CONCEPT. Details: https://support.h...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

EUVD-2026-60317

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

CVE-2026-46345

The vulnerable code output_file = trestle_root / r_output_file in trestle/core/commands/author/jinja.py accepts unvalidated -o/--output paths, enabling ../, ..\, or absolute path traversal. Exploitation is trivial (single command, no auth) and can overwrite .github/workflows/*.yml, .git/hooks/*, ...

CVE-2026-46345 compliance-trestle - jinja has an Arbitrary File Write via Path Traversal

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the -o/--output argument in trestle author jinja allows writing files outside the intended workspace. The application does not properly validate, ../, .., or absolute paths. This allows...

USN-8640-1: Engrampa vulnerability

It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

USN-8640-1 engrampa vulnerability

It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

GHSA-59FJ-M2J6-HCXH Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

extract-zip allows arbitrary file writes through symlink archive entries

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

GHSA-7PQW-9J4J-H8Q3 extract-zip allows arbitrary file writes through symlink archive entries

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

DEBIAN-CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-16137

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...

CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-16137 Path traversal via unsanitized upload filename leads to arbitrary file write in Progress ShareFile Storage Zones Controller

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...

CVE-2026-16137

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result...