CVE-2020-1048

CVE-2020-1048 Existe una vulnerabilidad de elevación de privilegios cuando el servicio Windows Print Spooler permite indebidamente la escritura arbitraria en el sistema de archivos. Un atacante que explotara con éxito esta vulnerabilidad podría ejecutar código arbitrario con privilegios elevados...

CVE-2026-88069

Pandora (a file-analysis platform) contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths are not validated to ensure the destination remains within the intended extraction directory, allo...

CVE-2026-74859

gnome-tweaks contains a path traversal vulnerability in its shell theme installer. The installer extracts user-supplied ZIP archives without validating archive member paths, allowing a crafted theme archive to write files outside ~/.themes via ../ sequences, absolute paths, or symlink entries. Th...

CVE-2026-85626 git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of gitlog, gitdiff, and gitshow tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

CVE-2026-85626

git-mcp-server 2.15.1 is affected by an argument injection vulnerability in the ref and object parameters of the git_log, git_diff, and git_show tools. The root cause is a lack of leading-dash validation , allowing attackers to inject git command-line options such as --output= and write files out...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Creating a malicious file using cmd/go can result in writing to a file controlled by an attacker, with partial control over the file’s content. The cgo pkg-config: directive in a Go source file provides command-line arguments that are passed to the Go pkg-config command. An attacker can provide a...

Astra Linux – Vulnerability in Grunt

The file.copy operations in GruntJS are vulnerable to a TOCTOU race condition, which can lead to arbitrary file writes in the GitHub repository gruntjs/grunt before version 1.5.3. This vulnerability allows for arbitrary file writes that can lead to local privilege escalation to the GruntJS user...

AZL-95813 CVE-2026-53785 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

CVE-2026-53803

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

CVE-2026-70558

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-71476 Nx: Zip-Slip in the self-hosted remote cache

Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path MITM remote cache server can return a crafted...

Malicious code in agenttunnels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...

CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

CVE-2026-70427 affects Jenkins 2.575 and earlier, and LTS 2.568.1 and earlier. The root cause is unsafe handling of symbolic links with effectively empty names during extraction of .tar and .tar.gz archives, allowing an attacker who can supply crafted archives to write files to arbitrary location...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...