489358 matches found
MAL-2026-18094 Malicious code in pafex (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f048e6c59bed3c95094e9baaf28b7234a917300b81a4c81db0eb0a3f859ff4e3 No install-time or import-time network I/O, credential access, subprocess execution, or other installer-harm behavior was observed in this package...
Exploit for CVE-2026-106173
CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File W...
cockpit-files security update
An update is available for cockpit-files. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A filesystem browser for Cockpit Security Fixes: cockpit-files:...
RLSA-2026:84595 Moderate: cockpit-files security update
A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...
CVE-2026-92483
A flaw was found in the Linux kernel's liveupdate component. When a retrieval attempt for a File List Block FLB fails, the system does not record this failure. Consequently, if a user attempts to retrieve another file associated with the same FLB, the system may retry the failed retrieval. This...
DEBIAN-CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
DEBIAN-CVE-2026-113352
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ftfindresumeable loads,...
CVE-2026-113354
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...
CVE-2026-108086
UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...
CVE-2026-113352
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ftfindresumeable loads,...
External Control of System or Configuration Setting
Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwar...
EUVD-2026-104929
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113358
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...
CVE-2026-113356 DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
CVE-2026-113356
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
EUVD-2026-104927
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...
CVE-2026-113356
DokuWiki versions prior to 2026-07-14c are vulnerable to a PHP object injection vulnerability within the Draft::getDraftText() function. The root cause is the use of unserialize() on draft file contents without restricting allowed classes. Authenticated users with edit rights can exploit a race c...
CVE-2026-113356 DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText that passes draft file contents to unserialize without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating...