319345 matches found
PYSEC-2026-3740
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
PYSEC-2026-3740
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
DEBIAN-CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
PYSEC-2026-3965
opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...
PYSEC-2026-3965
opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...
CVE-2026-81720
opensslencrypt before 1.4.9 fails to validate the memorycost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive...
CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
UBUNTU-CVE-2026-81726
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...
CVE-2026-81679
OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...
CVE-2026-81091
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...
CVE-2026-57499
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...
CVE-2026-40526
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...
CVE-2026-26899
An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...
GHSA-G7GW-M874-7RMF Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter
Summary The Kargo UI reads a redirectTo query parameter on the /login and /token-renew routes and, following a successful OIDC authentication, uses its value as the destination for client-side navigation. The parameter is treated as a path string but is not constrained to targets within the UI's...
EUVD-2026-28857
Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query Parameter...
NPM: n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
NPM: n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path dbpath parameter vulnerability discovered by ? in WordPress Npm n8n-nodes-sqlite3 versions 1.0.0...
n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...
GHSA-Q7M3-RHXG-7VXR n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)
Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...
