CVE-2026-73705

CVE-2026-73705 affects the API of HPE Networking Fabric Composer , where an arbitrary file write flaw allows an authenticated low-privilege operator to escalate privileges. Successful exploitation can lead to arbitrary command execution on the underlying operating system and complete compromise o...

EUVD-2026-69432

An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary commands on the underlying operating syste...

CVE-2026-73705 Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer

An arbitrary file write vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary commands on the underlying operating syste...

External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path and link following in its lockfile install path safejoinmodulesdir.rs in the bundled pacquet package manager, whose containment checks fail to...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

GHSA-X9R9-C232-4Q39 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

EUVD-2026-69288

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

CVE-2026-84201

appium-mcp-server through 0.1.61 is affected by a path traversal vulnerability in the write_file and write_files_batch tools. The server fails to validate or normalize file paths, allowing an attacker to supply absolute paths or relative paths with parent-directory segments to write files outside...

CVE-2026-84201 appium-mcp-server through 0.1.61 Path Traversal in write_file and write_files_batch

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the writefile and writefilesbatch tools, allowing attackers to write files outside the intended PROJECTROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrite...

CVE-2026-80047

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2024-14047

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

EUVD-2024-55738

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2024-14047 Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation...

CVE-2024-14047

CVE-2024-14047 is a local Improper Link Resolution Before File Access vulnerability in the Winlogbeat Windows installer (Elastic). The installer placed runtime files in a directory writable by unprivileged users, allowing a low-privileged attacker with existing system access to pre-position malic...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

EUVD-2026-69144

A vulnerability in Hugging Face Transformers versions = 4.49.0 and = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

CVE-2026-80047 Hugging Face Transformers library writes remote code to disk prior to consent check

A vulnerability in Hugging Face Transformers versions 4.57.0 to 5.16.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...