5796 matches found
PT-2026-49066
Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.6 Description An issue exists where the software fails to properly normalize file paths when creating zip or tar archives on Linux hosts. Specifically, the getFiles function uses filepath.ToSlash, which does...
CVE-2026-53836: Incomplete List of Disallowed Inputs
OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks...
WsgiDAV encoded dot segments can escape filesystem share roots
Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...
GHSA-WXQ4-CC2Q-338Q WsgiDAV encoded dot segments can escape filesystem share roots
Impact WsgiDAV 4.3.3 can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. Patches The issue is fixed with version 4.3.4. Preconditions The practical impact depends on the deployment. The deployment...
Authentication Bypass Using an Alternate Path or Channel
Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the StripPrefix process. An attacker can access protected backend endpoints and potentially execute unauthorized actions by crafting request paths containing .. or its...
Malicious code in webpack-cache-cycle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82fa37e2478a7109e376e3a062ccb203806511033930eb7390e45fe7ef404b81 On npm install, package.json's postinstall hook runs node -e "require'./loader.js'". loader.js spawns a detached node process that decodes a...
CLEANSTART-2026-BM78291 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Multiple security vulnerabilities affect the dex package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...
CLEANSTART-2026-SQ76279 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Multiple security vulnerabilities affect the dex package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...
CLEANSTART-2026-KN74022 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the local-static-provisioner-fips package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-XW33274 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin-fips package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-KV53168 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the kyverno-policy-reporter-kyverno-plugin package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
SolidInvoice 跨站脚本漏洞
SolidInvoice is an open-source invoice processing application developed by SolidInvoice. Versions of SolidInvoice prior to 2.3.17 contained a cross-site scripting vulnerability. This vulnerability stemmed from the company logo upload feature not verifying file types. As a result, authenticated...
PT-2026-48813
Name of the Vulnerable Software and Affected Versions WsgiDAV version 4.3.3 Description An issue exists in the FilesystemProvider. loc to file path function where the application fails to properly validate path boundaries when using a filesystem-backed share. The method uses...
MAL-2026-5526 Malicious code in chai-check-error (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e290b42de2cbd4aa74afa6550fc9a0381dfcb0f6996dcdc22254268b391f9f8 [email protected] impersonates the legitimate chaijs/check-error utility copied README, author metadata, repository URL, and exported API surfac...
fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator URL containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization...
CLEANSTART-2026-CP20786 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Multiple security vulnerabilities affect the nats-streaming package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU. See references for individual vulnerability details...
CLEANSTART-2026-WO91797 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the kube-state-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-JE84467 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the nats-streaming package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-IT61881 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the kube-state-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...
CLEANSTART-2026-LJ67798 Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU
Security vulnerability affects the kube-state-metrics package. Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU...