CVE-2024-14047

CVE-2024-14047 is a local Improper Link Resolution Before File Access vulnerability in the Winlogbeat Windows installer (Elastic). The installer placed runtime files in a directory writable by unprivileged users, allowing a low-privileged attacker with existing system access to pre-position malic...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability that allows an authenticated user with limited privileges to write attacker-controlled content to arbitrary filesystem paths. The CVSS 3.1 base score is 8.8 (HIGH) with a network attack vector and low complexity. The reference ...

CVE-2026-79683

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

EUVD-2026-69126

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths...

PT-2026-84487

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated arbitrary file write issue allows an authenticated actor to create or modify files and execute arbitrary commands as a privileged user on the underlying operating system. This...

PT-2026-84423

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write issue exists in the API of the software, which could allow an authenticated administrative user to escalate privileges. Successful exploitation...

PT-2026-84208

Name of the Vulnerable Software and Affected Versions Dell PowerStore affected versions not specified Description A protection mechanism failure allows an authenticated user with limited privileges to write attacker-controlled content to arbitrary filesystem paths. Recommendations At the moment,...

PT-2026-84483

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Authenticated path traversal vulnerabilities exist in API endpoints. Path traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folde...

PT-2026-84409

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description An arbitrary file write flaw exists in the API of HPE Networking Fabric Composer. This issue allows an authenticated user with low privilege operator permissions to...

PT-2026-84470

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An unauthenticated arbitrary file write issue exists in an API endpoint. This allows an attacker to write arbitrary files to the underlying operating system, which could potentially lead to...

TencentOS Server 4: moby (TSSA-2026:0872)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0872 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

CVE-2026-82393

pnpm prior to 10.34.5 and 11.11.0 is vulnerable to a scoped path traversal in a tarball dependency's package.json manifest name. The root cause is in pickPackage.ts (npm-resolver), which rejects slash characters only for unscoped names, allowing a crafted scoped name to reach raw path joins in re...

CVE-2026-79743

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743

MCPHub is a unified hub for managing and orchestrating MCP servers/APIs. Prior to version 0.12.13 , its MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field is directly concatenated into a file path without sanitization or path traversal character validatio...

EUVD-2026-68691

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...

CVE-2026-79743 MCPHub: Path Traversal via Malicious MCPB Manifest Name

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.13, MCPB File Upload Handler extracts a ZIP file and reads manifest.json from it. The name field in the manifest i...