13632 matches found
CVE-2026-55220: Deserialization of Untrusted Data
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...
CVE-2026-82264: Improper Limitation of a Pathname to a Restricted Directory
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
PT-2026-83253
Name of the Vulnerable Software and Affected Versions aqua versions prior to 2.60.1 Description In the handler.HandleFile function within pkg/unarchive/archives.go, the software fails to verify that the target of a symlink created via os.Symlink remains within the intended extraction destination....
PT-2026-83287
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...
PT-2026-83282
Name of the Vulnerable Software and Affected Versions amazon-ssm-agent versions prior to 3.3.4515.0 Description Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin allows an authenticated remote user with ssm:SendCommand permissions restricted to the...
PT-2026-82963
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A local unprivileged user can exploit a symlink-based pidfile clobbering issue in the intel-speed-select daemon. Because the daemon uses a fixed pidfile path under /tmp, an attacker can...
CVE-2026-55569: Improper Limitation of a Pathname to a Restricted Directory
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...
PT-2026-89230
GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...
CVE-2026-40541: Improper Neutralization of Input During Web Page Generation
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: cpio (UTSA-2026-092966)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-092966 advisory. cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. Tenable has...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gzip (UTSA-2025-002274)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002274 advisory. An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name for example, a crafted file nam...
CVE-2026-61800
Wazuh (open-source XDR/SIEM platform) versions 4.4.0 through 4.14.6 contain a flaw in cluster file synchronization. In the non-merged branch of update_master_files_in_worker() , staged files are moved to a destination derived only from safe_join(), which confines the path to /var/ossec but never ...
CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...
CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...
CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...
CVE-2026-81497
GHSA-4qxq-p5hm-3q3p: Arbitrary host file read+write via VM template path traversal...
CVE-2026-81493
GHSA-p2v3-6wvc-cv3p: Arbitrary file write on host via image fingerprint path traversal...
CVE-2026-81496
GHSA-26gp-p5fw-3r2h: Arbitrary file write on host via path traversal in instance backup import...