CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

DEBIAN-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

UBUNTU-CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal in the ensurePathIsContained function. An attacker can potentially access files outside the intended directory by manipulating file paths during the normalization process...

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

Directory Traversal

Overview @fastify/static is a Plugin for serving static files as fast as possible. Affected versions of this package are vulnerable to Directory Traversal via the static file handler process. An attacker can access protected files by submitting requests with non-canonical path segments, such as d...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677

Anki’s local HTTP server (prior to version 25.09.3) is vulnerable to directory traversal via unconstrained media and built-in data paths. Attackers could leverage scripts served from shared decks or malicious sites with an origin-check bypass to read local files. The issue is fixed in 25.09.3. Af...

CVE-2026-64677

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

[SECURITY] Fedora 44 Update: freeipa-4.13.2-1.fc44

IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...

CVE-2026-68770

A flaw was found in sentence-transformers. A remote attacker could exploit a logic flaw to bypass a security control designed to prevent the execution of untrusted code. This vulnerability allows for arbitrary code execution when an application loads a model from a directory that has been...

CVE-2026-61959

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-61959 WordPress Business Directory plugin <= 6.4.24 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-61959

The CVE-2026-61959 entry concerns a Cross Site Scripting (XSS) vulnerability in the WordPress Business Directory plugin, affecting versions

EUVD-2026-53956

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-16054

CVE-2026-16054 affects the Drag and Drop Multiple File Upload for WooCommerce WordPress plugin prior to 1.1.8. The issue permits unauthenticated users to obtain a valid nonce that gates the plugin’s file-deletion routine, enabling anonymous attackers to delete files staged in the upload directory...

EUVD-2026-53722

The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining a valid nonce that is the only control gating its file-deletion routine, allowing anonymous attackers to delete files staged in its upload directory and...

MAL-2026-13435 Malicious code in @united-airlines-org/atmos-design-system (npm)

The package @united-airlines-org/atmos-design-system contains a malicious preinstall script in its package.json that runs automatically during installation. The script executes curl to send the machine's hostname, obtained via uname -n and base64-encoded, to the attacker-controlled endpoint...