CVE-2026-54650

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

GHSA-6XX4-9WP6-65P7 skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

Impact skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine copydirall classified each entry with std::fs::DirEntry::filetype — which does not follow symlinks — and then copied non-directory entries with std::fs::copy, which does...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650 openhole-server vulnerable to path traversal via URL-decoded request path

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

EUVD-2026-50087

openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publicproxy.go forwarded r.URL.Path instead of preserving the original request target with r.URL.EscapedPath, allowing percent encoded dot segments %2e and separators %2f to reach...

CVE-2026-54650

CVE-2026-54650 describes a path traversal vulnerability in openhole-server prior to 0.1.2. In 0.1.1 and earlier, internal/server/public_proxy.go forwarded the request using r.URL.Path instead of preserving the original target via r.URL.EscapedPath(). This allowed percent-encoded dot segments (%2e...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the selecteval custom field type. An attacker can execute arbitrary Ruby code on the server by supplying a malicious expression in the field options command parameter, which is evaluated through instanceeval...

CVE-2026-14959

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

GHSA-6588-8GV4-XFGH Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in...

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

CVE-2026-14958 OS command injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation...

OPENSUSE-SU-2026:21470-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of service via TLS bsc1272223. - CVE-2026-46968: unauthorized creation, deletion or modification...

CVE-2026-14959

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14959 OS Command Injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14959 OS Command Injection in IBM Aspera Faspex

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection...

CVE-2026-14959

CVE-2026-14959 affects IBM Aspera Faspex 5, versioned 5.0.0 through 5.0.15.4. The vulnerability allows a remote authenticated attacker to execute arbitrary code via a shell command injection in Faspex components. Root cause: improper input handling enabling shell command execution. Impact: high w...