49283 matches found
CVE-2026-63293 Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...
Exploit for CVE-2026-17106
CopyEscape — PoC de CVE-2026-17106 Proof of Concept educati...
CVE-2026-52776
creationtimestamp| type| source ---|---|--- 2026-08-12 16:35:03+00:00| published-proof-of-concept| https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-h47f-gmjp-m7rr...
CVE-2026-70427
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction...
CVE-2026-65939
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...
CVE-2026-65940
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...
JLSEC-2026-1264 GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file...
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the user’s PATH, gzexe falls back to constructing a temporary file path based solely on the process ID PID. This predictable filename is created without...
CVE-2026-19429
A flaw was found in Jenkins. An authenticated remote attacker with low privileges could exploit an incomplete patch related to symlink validation during tar archive extraction. This vulnerability allows the attacker to bypass symlink target validation, enabling them to read arbitrary files on the...
EUVD-2026-57266
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...
CVE-2026-65940
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...
CVE-2026-65940 WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server...
CVE-2026-65940
WhatsUp Gold is affected in versions released before 2026.0.2. The issue stems from excessive file system permissions, enabling a privileged attacker to write arbitrary files to a web-accessible location on the host server. Remediation inferred: upgrade to 26.0.2 or later.
EUVD-2026-57264
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...
CVE-2026-65939
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...
CVE-2026-65939 WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root...
CVE-2026-65939
CVE-2026-65939 affects WhatsUp Gold releases prior to 2026.0.2. The issue allows a privileged attacker to create a LogToFile action that specifies an arbitrary file extension within the IIS web root, enabling potential unauthorized file writes. CVSS:3.1 base score 6.8 (MEDIUM), with an adjacent a...
GHSA-Q939-RPR3-3284 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...
CVE-2026-73291
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...