CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-104103

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-103975

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975

The @appium/support component in Appium (prior to version 7.2.6 ) is vulnerable to an arbitrary file write via a symlink-based ZIP Slip . The root cause is that the ZIP extraction process fails to validate the symlink target or the real destination during a lexical containment check. An attacker-...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-103975 Appium: Symlink based Zip Slip in @appium/support ZIP extraction

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later...

CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-104103

The Ludwig low-code AI framework (prior to version 0.17.8 ) is vulnerable to a path traversal flaw in the ludwig.datasets.archives.extract_archive() function. The root cause is the failure to validate symlink and hard-link members before calling TarFile.extractall(). An attacker can provide a cra...

CVE-2026-104103 Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

EUVD-2026-101522

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-110777 Evolution-data-server: local file disclosure via attach file:// uris

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-110777

A flaw in evolution-data-server allows for local file disclosure. When a user saves a calendar event containing a file:// URI in its ATTACH property, the application automatically reads the targeted local file, encodes the content in base64, and uploads it to the server. Because there are no file...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

EUVD-2026-101521

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-110777 Evolution-data-server: local file disclosure via attach file:// uris

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-110777

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

EUVD-2026-101518

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...

CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB dat...