CVE-2026-74235

GFI Exinda AI versions before 7.6.5 are affected by a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function accepts parameters prefixed with v_del_ and appends their values directly to the base configuration directory path withou...

CVE-2026-71197

A flaw was found in OpenStack Glance. The web-download image import method can bypass host-based blocklist filtering. When an operator configures disallowedhosts with IP addresses to block access to internal services, an attacker can circumvent this protection by using a hostname that resolves to...

BIT-JOOMLA-2026-71572 Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

CVE-2026-71196

A server-side request forgery SSRF vulnerability was found in OpenStack Glance. The web-download image import method allows authenticated users to provide a URI from which the Glance service fetches data. Due to insufficient default host filtering, an attacker with standard tenant credentials can...

MAL-2026-15915 Malicious code in text-transform-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip ...

MAL-2026-15916 Malicious code in xcryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 989e6d862a8e433df7f0bd31ab9a6b76f616273783517c81f5e428ad2774ad4e The package declares a postinstall script scripts/install.js that on npm install downloads a ZIP archive from...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85672: Improper Neutralization of Special Elements used in an OS Command

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

PT-2026-85517

GFI Exinda AI before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf handle download function accepts parameters prefixed with v del and appends their values directly to the base configuration directory path without sanitizing for...

PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

GHSA-H6CJ-26G5-67FV OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

Summary Alist's offline-download feature POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602

OpenList (a file list program supporting multiple storage backends) versions prior to 4.2.3 are affected by an authenticated path traversal vulnerability in the offline-download feature. When the SimpleHttp tool is used via POST /api/fs/add_offline_download, an attacker-controlled Content-Disposi...

EUVD-2026-70550

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-75602 OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

EUVD-2026-70484

Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloads to arbitrary hosts. An attacker can control a registry, serve a malicious tensor-layer manifest, and cause the server to issue GET requests to internal...

Defcon-Dreamcast-Planetweb-Research

PlanetWeb Dreamcast Browser v3.0 — Eden service-subscription R...

CVE-2026-75602: Improper Limitation of a Pathname to a Restricted Directory

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...