1583 matches found
CVE-2026-67920: External Control of File Name or Path
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...
External Control of File Name or Path
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
CVE-2026-34492
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-16708
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...
CVE-2026-34492
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-17184
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17184, enabling a remote attacker to execute arbitrary code due to external control of a file name or path. The issue affects the GUI and related components of IBM Db2 Mirror for i. IBM’s bulletin lists remediation via platf...
CVE-2026-16708
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...
PT-2026-72109
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-16708: External Control of System or Configuration Setting
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...
CVE-2026-34492: External Control of File Name or Path
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-17184: External Control of File Name or Path
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...
EUVD-2026-56157
External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...
CVE-2026-18127
CVE-2026-18127 affects Ivanti Endpoint Manager core prior to 2024 SU7. An authenticated, network-accessible attacker can externally control a filename in the Core, enabling full write access to an S3 bucket used for session-recording storage. The CVSS score is 7.7 (HIGH); attack requires low priv...
MAL-2026-13678 Malicious code in svelte-map-visual (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...
External Control of File Name or Path
Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the remove and checkout functions. An attacker can access the contents of arbitrary files by supplying crafted arguments to...
External Control of System or Configuration Setting
Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the window.open. An attacker can cause the main process to access...
CVE-2026-18806
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0...
MAL-2026-12009 Malicious code in @keyv/compress-brotli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...
CVE-2026-18806 Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0...