42 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-103060
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a...
CVE-2026-103061
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...
EEF-CVE-2026-103061 Path traversal in Gleam via unvalidated package application names
Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an ap...
CVE-2026-103061
The gleam-lang gleam compiler is vulnerable to a Path Traversal (CWE-22) issue in versions 0.32.4 through 1.19.2 . The root cause is the lack of validation on the app field within Hex package metadata, which the compiler uses to determine build directory names. A malicious publisher can provide a...
UBUNTU-CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
DEBIAN-CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2017-20285
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...
CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash into the class it names. The document supplies the object's fields, and Perl calls DESTROY when it goes out of scope. What DESTROY does depends on th...
CVE-2017-20285
YAML versions before 1.30 for Perl are vulnerable to a flaw where a loaded document can trigger the DESTROY method of arbitrary classes. The vulnerability occurs because a perl/hash:Class tag blesses a hash into a class named in the document; when the object goes out of scope, Perl executes its d...
EUVD-2026-22331
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with...
CVE-2026-33027
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operati...
CVE-2026-33027 Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operati...
EUVD-2025-207549
A vulnerability was determined in MuYuCMS 2.7. Affected is the function deletedirfile of the file application/admin/controller/Template.php of the component Template Management Page. This manipulation of the argument temn/tp causes path traversal. It is possible to initiate the attack remotely. T...
CVE-2026-2953
A vulnerability has been found in Dromara UJCMS 101.2. This issue affects the function deleteDirectory of the file WebFileTemplateController.delete of the component Template Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed...
PT-2026-21452
Name of the Vulnerable Software and Affected Versions Dromara UJCMS version 101.2 Description A path traversal issue exists in Dromara UJCMS version 101.2. This is due to manipulation of the deleteDirectory function within the WebFileTemplateController.delete file of the Template Handler componen...
CVE-2026-27181
MajorDoMo aka Major Domestic Module allows unauthenticated arbitrary module uninstallation through the market module. The market module's admin method reads gr'mode' from $REQUEST and assigns it to $this-mode at the start of execution, making all mode-gated code paths reachable without...
CVE-2025-56430
Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.php and the deleteDirectory function...