CVE-2026-78624

Okta Access Gateway contains an improper path validation flaw in its backup restore function . The function does not validate the filename embedded in an encrypted backup payload, allowing file contents to be written to unintended locations on the appliance filesystem. The vulnerability is rated ...

PT-2026-88435

Name of the Vulnerable Software and Affected Versions Okta Access Gateway affected versions not specified Description The backup restore function fails to validate the filename embedded within an encrypted backup payload. This flaw allows file contents to be written to unintended locations on the...

SUSE CVE-2026-71311

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

SUSE CVE-2026-71313

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From v1.51.0 until v1.75.0, the local backend in backend/local/local.go relies on the configurable filename encoder to prevent remote filename data from becoming operating-system path...

CVE-2026-85696

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

EUVD-2026-71145

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696

SadTalker (OpenTalker), a talking-head video generation tool, contains an OS command injection vulnerability in its video muxing process . In version v0.0.2 , uploaded audio filenames are interpolated into ffmpeg commands without proper escaping (see src/utils/videoio.py). An attacker can upload ...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85696 SadTalker OS Command Injection via Audio Filename

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

CVE-2026-85684

marker through version 2.0.0 contains a path traversal vulnerability in its FastAPI /marker/upload handler. The root cause is a failure to sanitize the file.filename parameter, allowing unauthenticated attackers to supply filenames containing directory traversal sequences. This permits writing ar...

CVE-2026-85684 marker through 2.0.0 Path Traversal via upload filename

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

EUVD-2026-71133

marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename parameter. Unauthenticated attackers can supply filenames containing directory traversal sequences to write arbitrary files to any location or delete existin...

Exploit for CVE-2024-36057

CVE-2024-36057 — Koha Library Software CVE ID: CVE-2024-3...

PT-2026-85582

SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ffmpeg commands without proper escaping. Attackers can upload audio files with shell metacharacters in the filename to break out of quoted arguments and execut...

MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...

CVE-2026-82521

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...

CVE-2026-82521 parsedmarc 9.0.6 < 11.0.1 Path Traversal via Forensic Report Subject

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...

USN-8723-1 spice-vdagent vulnerabilities

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...

USN-8723-1: SPICE vdagent vulnerabilities

It was discovered that SPICE vdagent had an integer overflow in the buffer size calculation used when writing to the daemon socket. A malicious or compromised SPICE host could possibly use this issue to cause SPICE vdagent to crash, resulting in a denial of service. CVE-2026-57965 It was discover...