CVE-2026-77317 SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins...

CVE-2026-77317

CVE-2026-77317 affects SeaweedFS (distributed file/blob storage system) versions 3.88 through 4.39. The SFTP server evaluates configured path permissions using a literal string-prefix comparison rather than requiring a path-component boundary. A user scoped to a path such as /tenants/alice is als...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Escalação de Privilégio Local - Vulnerabilidade de Sobrescrita Arbitrária de Arquivos Resumo da Vulnerabilidade Uma vulnerabilidade de escalação de privilégio local no sistema operacional Windows foi identificada nas versões = 2.0.36.0 do MSI Center, que permite a um...

CVE-2025-64095

=== Descrizione === DNN precedentemente DotNetNuke è una piattaforma di gestione dei contenuti web CMS open-source nell'ecosistema Microsoft. Prima della versione 10.1.1, il provider di editor HTML predefinito consente il caricamento di file non autenticati e le immagini possono sovrascrivere fil...

POC-CVE-2025-24813

CVE-2025-24813 – Ambiente di Dimostrazione PoC Questo repository contiene una semplice applicazione costruita per osservare il comportamento di CVE-2025-24813, una vulnerabilità recente in Apache Tomcat relativa all'uso del DefaultServlet con scrittura abilitata readonly=false, che consente...

CVE-2026-59682

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-59682 Arbitrary file overwrite and deletion local and remote in OpenRGB

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-59682

OpenRGB through 1.0rc3 is affected by an arbitrary file overwrite and deletion vulnerability via the SAVE_PROFILE message, allowing both local and remote exploitation. Per CVSS 3.1, this is rated CRITICAL (9.1) with a network attack vector requiring no privileges and no user interaction , resulti...

EUVD-2026-66380

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

RockyLinux 10 : golang (RLSA-2026:22120)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22120 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

RockyLinux 8 : go-toolset:rhel8 (RLSA-2026:22112)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22112 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass...

PT-2026-82050

Arbitrary file overwrite via SAVE PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcp (UTSA-2026-093148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093148 advisory. A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUS...

CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637 Velero vulnerable to file path traversal when extracting from backup's tarball

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-79781

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability in its handling of S3 object keys. An unauthenticated, network-based attacker can include dot-dot (../) segments in object key names (e.g., ../root-secret.txt) to escape the bucket namespace and read or overwrite files ...

CVE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...