33267 matches found
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...
Improper Input Validation
Overview Affected versions of this package are vulnerable to Improper Input Validation via the imageDownload process. An attacker can overwrite arbitrary files on the host system and potentially execute arbitrary commands as root by supplying a crafted Incus-Image-Hash header containing directory...
WordPress MapSVG plugin <= 8.6.4 - Arbitrary File Download vulnerability
Arbitrary File Download vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.6.4...
MAL-2026-6510 Malicious code in @merceas/cross-fetch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6307129b7d9edcbd76ffc93c9d8a6ae146332951d5ce90e659afe1eec01127 Package is published under the @merceas scope as cross-fetch and reuses the upstream cross-fetch README, homepage github.com/lquixada/cross-fetch, an...
Malicious code in openblox (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdd874a78973f84b5373fc03a48472c338ca82ef0a258b7614f81a8359da1201 setup.py invokes GetGitCommitHash unconditionally at module top level, so it runs on pip install openblox and any setuptools invocation. On Windows t...
EUVD-2025-210336
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile, where a fallback file-lookup path constructed...
Malicious code in kelly-stake (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...
GO-2026-5669 Gotenberg has a Race Condition via Multipart `downloadFrom` Handling in github.com/gotenberg/gotenberg
Gotenberg has a Race Condition via Multipart downloadFrom Handling in github.com/gotenberg/gotenberg...
GO-2026-5659 File Browser share links remain accessible after Share/Download permissions are revoked in github.com/filebrowser/filebrowser
File Browser share links remain accessible after Share/Download permissions are revoked in github.com/filebrowser/filebrowser...
GO-2026-5536 Gogs Missing Authorization in Attachment Download in gogs.io/gogs
Gogs Missing Authorization in Attachment Download in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...
GO-2026-5530 Note Mark has Broken Access Control on Asset Download in github.com/enchant97/note-mark/backend
Note Mark has Broken Access Control on Asset Download in github.com/enchant97/note-mark/backend...
CVE-2026-54096
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, POST /api/share/ accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target fi...
CVE-2026-44017
A flaw was found in Docling. The EasyOCR model download functionality improperly extracts ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker compromises the model download source e.g., via a supply chain or Man-in-the-Middle MITM attack, they could write...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade...
GO-2026-5334 Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea
Gitea: Token scope bypass on web archive download endpoint in code.gitea.io/gitea...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade gitea.dev/routers/web/repo to versi...
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization through the web archive download endpoint. An attacker can access resources beyond their authorized token scope by sending crafted requests to this endpoint. Remediation Upgrade gitea.dev/services/context to versi...