Linux Distros Unpatched Vulnerability : CVE-2026-102731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing...

Linux Distros Unpatched Vulnerability : CVE-2026-103880

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30 in a LDAP...

Linux Distros Unpatched Vulnerability : CVE-2026-103885

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API like Apache DS may consume 100% of a CPU core...

Directory Traversal

Overview @angular/ssr is a the Angular server side rendering utilities. Affected versions of this package are vulnerable to Directory Traversal in the prerendered page lookup of CommonEngine in packages/angular/ssr/node/src/common-engine/common-engine.ts, which confirms containment with...

CVE-2026-103877

A flaw was found in Apache Directory LDAP API. This vulnerability allows a rogue or compromised LDAP server, or a network attacker performing a man-in-the-middle MitM attack, to execute arbitrary code on the client. During a schema search request, an attacker can return a crafted schema object...

CVE-2026-103885

A flaw was found in Apache Directory LDAP API. This vulnerability allows an attacker to cause a Denial of Service DoS by submitting specially crafted telephone numbers to an LDAP Lightweight Directory Access Protocol server using the library. Processing these malformed inputs causes indefinite CP...

CVE-2026-103552

A flaw was found in Apache Directory LDAP API. An unauthenticated remote attacker can cause a Denial of Service DoS by submitting a deeply nested search filter before authenticating binding with the server. Processing this filter triggers a stack overflow in the server decoder, resulting in an...

CVE-2026-102731

A flaw was found in Apache Directory LDAP API. A remote unauthenticated attacker or man-in-the-middle actor can trigger this vulnerability by sending a specially crafted Basic Encoding Rules BER encoded message with an excessive size value. This causes the application to allocate an excessive...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Versions of Trivy prior to 0.71.0 are vulnerable to a directory traversal issue within Terraform filesystem functions . The root cause occurs when these functions attempt to access pathnames located above the designated scan root. This risk is particularly relevant when performing misconf scannin...

EUVD-2026-91789

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104994

Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input e.g., upon a third-party pull request that contains a Terraform configuration, if sensitive data c...

CVE-2026-104871 Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via validatepath in dulwich/index.py when processing tree entries whose leading path component is a DOS drive-letter prefix e.g., C:. On Windows, os.path.joinroot, b"C:..." discards the work-tree root and resolves to...

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

GHSA-CM62-GVXX-VMXX Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...