Apostrophe Technologies ApostropheCMS Path Traversal Vulnerability

Apostrophe Technologies ApostropheCMS has a path traversal vulnerability. This vulnerability arises when the paths controlled by attackers reach the local backend, including segments of the parent directory. This allows for the escape of the configured upload directory, leading to path traversal...

Apple macOS numerical error vulnerability

Apple macOS versions prior to Golden Gate 27, Apple macOS Sequoia 15.8, and Apple macOS Tahoe 26.7 have security vulnerabilities. These vulnerabilities stem from integer underflow, which may lead to unexpected system termination when attackers control network file servers...

Apache Cocoon information disclosure vulnerability

All versions of Apache Cocoon are affected by an information disclosure vulnerability. This vulnerability arises when sensitive system information is exposed to unauthorized control domains. Unauthenticated attackers can access the diagnostic interface, triggering caching mechanisms and resulting...

tox-dev filelock backend link vulnerability

In versions of tox-dev FileLock from 4.0.0 to 4.2.1, there was a post-processing link vulnerability. This vulnerability stemmed from SoftReadWriteLock’s mechanism for refreshing holder records by name. Local users with permission to rename lock directories could replace the records with named...

WordPress Aspose Doc Exporter path traversal vulnerability

Versions of Aspose Doc Exporter 2.0 prior to version 2.0 contain a path traversal vulnerability. This vulnerability arises from the lack of cleaning the path passed to the readfile function. Unauthenticated attackers can download arbitrary files by sending a GET request with the file parameter...

Optimal IdM OptimalCloud: Input validation error vulnerability

The Optimal IdM OptimalCloud 5.0 version has a vulnerability related to input validation errors. This vulnerability stems from improper handling of the state parameter in the file/v5.0/social, which may lead to open redirection. Attackers can trigger this remotely...

DokuWiki.org DokuWiki deserialization injection vulnerability

DokuWiki.org: Versions prior to DokuWiki 2026-07-14c contained a deserialization injection vulnerability. This vulnerability stemmed from the use of Draft::getDraftText, which passed the content of the draft file to unserialize, without restricting the classes allowed. Authentication users with...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111053

The open source billing platform FOSSBilling is vulnerable to a path traversal flaw in versions 0.1.0 through 0.8.7. The api/guest/system/template_exists endpoint improperly handles the file parameter by using Path::join without filtering .. sequences or validating the resolved path against the a...

EUVD-2026-104412

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

MAL-2026-17954 Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff887d27322671592352c1e6755c4c39bc7be6f1bbb2148dc69ce2d3018a63e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in alb-um-availa-ble-zip-mp3-file-31673-finally-1m7lu-usrooy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cab30295e4c047eb1dd313b68001538fdd727e2bd49f3aac87fe67d10e9236b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4c7c4064762128656fff603f846e8eca4e3458cb6bae2bee941f7f63b816af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwn

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...