GO-2026-6314 Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua...

Updated bubblewrap package fixes security vulnerabilities

Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup...

MGASA-2026-0371 Updated bubblewrap package fixes security vulnerabilities

Sandbox escape: symlink traversal via /oldroot allows writing files outside sandbox during setup...

CVE-2026-52832

Nuclio (a serverless framework for real-time event/data processing) is affected by an unauthenticated path traversal in the Dashboard's POST /api/functions endpoint. In the default NOP auth mode, the spec.handler field is parsed by functionconfig.ParseHandler() which splits on : without path vali...

CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-52832 Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which split...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

EUVD-2026-70143

Jenkins File Parameter Plugin 425.v3fa801681b5e and earlier allows writing files to arbitrary locations on the Jenkins controller file system through Stapler data binding, which can lead to remote code execution...

CVE-2026-84671

The Jenkins File Parameter Plugin (versions 425.v3fa_801681b_5e and earlier) is vulnerable to a path traversal flaw. The root cause is that the plugin uses the Stapler framework's @DataBoundConstructor to instantiate objects and bind submitted data, but fails to validate parameter names when stor...

Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

EUVD-2026-63414

Banks: Path traversal in DirectoryPromptRegistry.set allows arbitrary file write outside the registry root...

GHSA-X8WG-4XGC-VR54 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Summary The virtual store linker constructs package installation directories using path.joinmodules, pkgName where pkgName is extracted from lockfile packages keys via dp.parsedepPath.name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys e.g.,...

GHSA-C59Q-G84Q-2GJ5 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Summary The virtual store linker constructs package installation directories using path.joinmodules, pkgName where pkgName is extracted from lockfile packages keys via dp.parsedepPath.name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys e.g.,...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal @x/../../…/ is therefore extracted outside nodemodules, to an attacker-chosen absolute path,...

NPM: pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

NPM: pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.5...

GHSA-VQ4V-J7R6-JQ4M pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal @x/../../…/ is therefore extracted outside nodemodules, to an attacker-chosen absolute path,...