33004 matches found
PT-2026-82336
Name of the Vulnerable Software and Affected Versions Zyplayer-Doc versions 1.0.0 and earlier Description An issue exists that allows Server-Side Request Forgery SSRF, a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: openssh (UTSA-2026-104824)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104824 advisory. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is used with an attacker-controlled server. Tenable...
CVE-2026-75332
Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...
CVE-2026-75332
Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...
CVE-2026-80191: Missing Authorization
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...
CVE-2026-75413
DocSys V2.02.80 is vulnerable to an Any File Download flaw. An unauthenticated attacker can utilize the downloadDocEx.do interface to download any file by manipulating the targetPath parameter. This vulnerability allows for unauthorized access to files or directories. No specific remediation, exp...
CVE-2026-61792: Improper Limitation of a Pathname to a Restricted Directory
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...
CVE-2026-80191
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries n...
CVE-2026-79792 zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...
CVE-2026-79792
zackees transcribe-anything up to version 4.1.0 is affected by an OS command injection in the ytdlp_download function within src/transcribe_anything/ytldp_download.py (component: Yt-dlp Download). The flaw is triggered by manipulating the url argument, allowing a remote attacker to execute arbitr...
CVE-2026-79792
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlpdownload of the file src/transcribeanything/ytldpdownload.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection. The attack may be initiated remotely. T...
GO-2026-6289 Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve
Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve...
browse-mcp has an arbitrary file write via unconfined download and state paths
Impact browserdownload wrote a fetched file to joinsavedir, filename with no validation of savedir, and browsersavestate / browserloadstate honored an explicit path unchanged. The MCP caller controls these arguments a malicious MCP client, or an autonomous agent steered by indirect prompt injecti...
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths
NPM: browse-mcp has an arbitrary file write via unconfined download and state paths vulnerability discovered by ? in WordPress Npm browse-mcp versions = 0.8.1...
CVE-2026-79785
X-AnyLabeling's model downloader disabled TLS certificate verification by calling ssl._create_unverified_context() in download_with_retry (within anylabeling/services/auto_labeling/model.py), so neither the certificate chain nor hostname was validated when fetching models over HTTPS. An attacker ...
CVE-2026-79785 X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model Downloads
X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...