CVE-2026-103975

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-104103

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-103975

The @appium/support component in Appium (prior to version 7.2.6 ) is vulnerable to an arbitrary file write via a symlink-based ZIP Slip . The root cause is that the ZIP extraction process fails to validate the symlink target or the real destination during a lexical containment check. An attacker-...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-104103

The Ludwig low-code AI framework (prior to version 0.17.8 ) is vulnerable to a path traversal flaw in the ludwig.datasets.archives.extract_archive() function. The root cause is the failure to validate symlink and hard-link members before calling TarFile.extractall(). An attacker can provide a cra...

CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

EUVD-2026-101522

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-92153

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92153 F´: Arbitrary File Write in Svc::FileUplink via attacker-controlled StartPacket.destinationPath

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

CVE-2026-92153

The F´ (F Prime) framework, used for spaceflight and embedded software, contains an arbitrary file write vulnerability in Svc::FileUplink prior to version 4.3.0 . The root cause is that the system copies the destinationPath from Fw::FilePacket::StartPacket and opens it for writing without canonic...

CVE-2026-76519

Cisco Secure Email Gateway is vulnerable to a relative path traversal flaw in its Advanced Malware Protection (AMP) feature. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment to write arbitrary files on the underlying opera...

EUVD-2026-101420

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

CVE-2026-76519 Cisco Secure Email Gateway Arbitrary File Write Vulnerability

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

CVE-2021-31800-Impacket-SMB-Server-Arbitrary-file-read-write

CVE-2021-31800 - Impacket SMB Server Arbitrary file read/write CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Score : 9.9 Critical Description A path traversal in smbserver.py allows an attacker to read/write arbitrary files on the server. Detailed explanation of this issue:...

CVE-2026-35204

CVE-2026-35204 This repository represents a PoC to a CVE-2026-35204 Description "Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, a specially crafted Helm plugin, when installed or updated, will cause Helm to write the contents of the plugin to an arbitrary filesystem...