CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package...

CVE-2026-51906

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

CVE-2026-103648

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

EUVD-2026-91752

Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory...

CVE-2026-104843

The Python package and project manager uv (written in Rust) is vulnerable to a path traversal flaw during wheel extraction on Windows systems. Affected versions range from 0.12.7 until 0.12.18 . An attacker can trick a user into installing a specially crafted Python wheel package that, during ext...

CVE-2026-104843 uv: Path traversal on Windows through wheel extraction

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

CVE-2022-43293

CVE-2022-43293 のエクスプロイト 上記のPOCで示しているような永続的なWindowsサービス拒否（DoS）を発生させるには、Exploit.batを実行し、上書きしたいファイルを尋ねられたら%windir%\system32\cng.sysと入力するだけです。 こちらから、私の任意ファイル書き込み\上書きの脆弱性 レポートを参照できます。 こちらでは、任意ファイル書き込み\上書き プリミティブを使用して 、Windowsサービス拒否（DoS） を達成する方法を理解できます。 こちらから私にユニコーンを買ってくれます 🦄 知識を共有しましょう！...

CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-18953

CVE-2026-18953 — PoC 通过 awslabs.aws-transform-mcp-server （AWS Transform MCP 服务器）中 getresource 工具的 savePath 参数实现任意文件写入。 | ---|--- CVE| CVE-2026-18953 CWE| CWE-22 — 对受限目录的路径名限制不当 受影响版本| awslabs.aws-transform-mcp-server 0.1.0 – 0.1.4 修复版本| 0.1.5 CVSS v3.1| 8.6 高危 — AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:...

Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

CVE-2026-20230 Cisco Unified Communications Manager SSRF 任意文件書き込みからRCEへのPoC導出プロセスと考察 適用範囲：ローカルターゲット、許可された再現環境、脆弱性検証、防御ルール分析のみ。未承認のターゲットに対して使用しないこと。本記事は主にCVE-2026-20230の攻撃チェーン、検証可能な現象、判断ロジック、防御の考え方を分析するものであり、直接コピーして実行可能な攻撃パケット、WebShellの内容、コマンド実行ペイロードは提供しない。 1. 脆弱性の背景 CVE-2026-20230は、Cisco Unified...

Security update for helm

This update for helm fixes the following issues: CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows internal...

SUSE-SU-2026:4417-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...

Lack of vulnerability protection in Fortinet FortiMail

Fortinet has identified a vulnerability in FortiMail. FortiMail contains a critical vulnerability CVE-2026-104286 in the processing of file paths, caused by a combination of Path Traversal CWE-22 and insufficient neutralization of NULL bytes CWE-158. An unauthorized attacker can use specially...

CVE-2025-8110

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC 针对 CVE-2025-8110 的 PoC：Gogs ≤ 0.13.3 存在经过身份验证的任意文件写入漏洞，根源在于 PutContents API 对符号链接的处理不当。 经过身份验证的用户可以提交一个指向 .git/config 的符号链接，然后使用该 API 覆盖它并注入恶意的 sshCommand，从而实现远程代码执行。 免责声明 仅用于教育和授权测试。请勿对非您所有或未经明确许可的系统使用。 用法 chmod +x poc.sh ./poc.sh \ -i \ -P \ -u \ -p \ -t \ ...

MAGNOLIA-8348

MAGNOLIA-8348：Magnolia CMS 中的 FreeMarker 限制绕过 3 Magnolia CMS v6.2.17 及更低版本的 FreeMarker Filter 存在一个问题，允许攻击者通过精心构造的 FreeMarker 载荷绕过安全限制并执行任意代码、读取/写入/移动/复制/删除任意文件或发起 DoS 攻击。通过写入任意 JSP 文件，已成功实现任意代码执行。 协作： 此漏洞是与 Marian-Razvan Ilisanu 合作发现的。 厂商披露： 此漏洞的厂商披露与修复方案可在此处查看。 为何没有 CVE？ 我和厂商均未为这些漏洞申请 CVE。 概念验证：...

MAL-010

MAL-010：Apache James 中可通过 JMX 访问的危险 MBeans 通过列出并检查 localhost 端口 9999 上 JMX 公开的 MBeans，已识别出以下攻击向量： 使用 Log4J 进行任意文件写入 使用 Log4J 进行任意文件读取 注意： 与 CVE-2023-26269 中介绍的 “MLet 攻击” 不同，如果要求身份验证，只要攻击者知道 JMX 凭据，此漏洞也同样有效。 厂商披露： 此漏洞代表 CVE-2023-26269 的另一种攻击途径，因此厂商针对此漏洞的披露和修复可参见此处。 概念验证： 更多详情和利用过程可参见此 PDF。 其他资源：...

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes

The U.S. Cybersecurity and Infrastructure Security Agency CISA, on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities KEV catalog, following reports of active exploitation. The vulnerability, tracked as CVE-2026-104286 CVSS score: 9.8,...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – 无认证的 DICOM 网络图像注入 程序代码 Python pydicom dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No authentication, accepts any image from any remote...