CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-104103

The Ludwig low-code AI framework (prior to version 0.17.8 ) is vulnerable to a path traversal flaw in the ludwig.datasets.archives.extract_archive() function. The root cause is the failure to validate symlink and hard-link members before calling TarFile.extractall(). An attacker can provide a cra...

EUVD-2026-101522

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

LocalStranger

LocalStranger LocalStranger is a Proof of Concept project designed to demonstrate how dangerous a vulnerable kernel-mode driver actually is. WinNotify.sys as I call it, msft.sys, is a very dangerous vulnerable driver exposing arbitrary kernel primitives due to a complete lack of caller validation...

EUVD-2026-101496

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-86461 FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.10...

CVE-2026-92153

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing...

Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind

Summary IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-83557 DESCRIPTION: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever...

CVE-2026-33798

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series allows an L2-adjacent attacker to execute arbitrary code as root via high-availability fabric traffic...

CVE-2026-102055

A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Networks Junos OS on MX Series and Junos OS Evolved on PTX Series platforms allows an unauthenticated adjacent-network attacker to execute arbitrary code as root or cause denial of service via a specific CFM Message sent t...

CVE-2026-101955

A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper Networks Junos OS on SRX series allows an unauthenticated remote attacker to cause arbitrary code execution or a denial of service via a injected malformed DNS packet when Anti-Spam SBL inspection is enabled...

CVE-2026-108390 HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

EUVD-2026-101308

Hestia Control Panel is a lightweight and powerful control panel for the modern web. From version 1.9.7 through 1.10.4, updateobjectvalue in func/main.sh does not escape single quotes when writing a custom document-root value to a user's web.conf file, allowing a low-privileged authenticated pane...

CVE-2026-101981

A Stack-based Buffer Overflow vulnerability exists in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved . When LDP is enabled , an unauthenticated adjacent LDP peer can exploit this flaw by sending a malformed LDP Label Mapping message . This could result in an r...

EUVD-2026-101416

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent LDP peer to cause an rpd crash or execute arbitrary code via a malformed LDP Label Mapping message...