CVE-2026-12339: Improper Limitation of a Pathname to a Restricted Directory

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten...

CVE-2026-72567: Improper Limitation of a Pathname to a Restricted Directory

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

Photon OS 5.0: Python3 PHSA-2023-5.0-91-0139

An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0139. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-99858

Name of the Vulnerable Software and Affected Versions kubectl affected versions not specified Description A path traversal issue exists in the kubectl cp command for clients running on Windows. When copying files from a container, the client executes the tar binary within the container to create ...

NGINX Agent config_dirs Unauthorized Access

The vulnerability of the configdirs directive in the NGINX Agent and the NGINX Instance Manager automation platform is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to read and write arbitrary...

Exploit for CVE-2026-18953

CVE-2026-18953 — PoC Arbitrary file write in awslabs.aws-t...

Malicious code in sme-rko-finance-front-operations-notifications-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1d9ca70f719a1aa76a11ce147945ee7acefdb72bcbf955d1c7cd30a5d9f85e8 On require of the package, index.js side-effect loads polyfill.js and lib/telemetry.js, both of which act as native-binary droppers. Hostnames and...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:21543-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21543-1 advisory. Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potentia...

CVE-2026-48047

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

CVE-2026-48047

Affected component: XWiki Platform WebJars API (org.xwiki.platform:xwiki-platform-webjars-api). Vulnerability: Path traversal that can let an attacker write arbitrary files (e.g., configuration files or superadmin password) after installing a malicious WebJar extension and publishing it to a conf...

CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from (subwiki) admin

XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...

AZL-94673 CVE-2026-71557 affecting package cri-o 1.30.1-1

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

AZL-95487 CVE-2026-71557 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

AZL-95484 CVE-2026-71556 affecting package packer for versions less than 1.9.5-20

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

UBUNTU-CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

UBUNTU-CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...

CVE-2026-71556

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations including checkout, status, and add resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted reposito...