CVE-2026-47764

A flaw was found in pdm, a Python package and dependency manager. This vulnerability allows a remote attacker to write arbitrary files to a system by crafting a malicious Python 'wheel' package. The flaw occurs during the installation process, where a critical function responsible for writing fil...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

CVE-2026-58072

CVE-2026-58072 : The vulnerability affects the Veeam Service Provider Console. It enables arbitrary file write on the management server, which can lead to remote code execution. The CVSS v4.0 score is 9.0 (CRITICAL) with network attack vector, no user interaction, and high impacts on confidential...

CVE-2026-58072

A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution...

PYSEC-2026-3606 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such ...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

PT-2026-67758

Name of the Vulnerable Software and Affected Versions Veeam Service Provider Console affected versions not specified Description A flaw allows an attacker to perform an arbitrary file write on the management server, which can potentially lead to remote code execution RCE, a situation where an...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction

A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...

CVE-2026-15601 Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

CVE-2026-15601

The CVE affects the Kirki plugin for WordPress (versions

CVE-2026-15601

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

EUVD-2026-51745

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal Zip Slip in all versions up to, and including, 6.0.13 via the extractzipfile function. This makes it possible for authenticated attackers, with custom-level access and above, to...

VulnCheck KEV: CVE-2026-48313

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to improper enforcement of the permission model in the process.report. An attacker can access or overwrite files outside of the intended --allow-fs-write paths by leveraging this flaw to bypass security boundarie...

SUSE CVE-2026-6815

An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem,...