CVE-2026-93320 BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-93320

BuildKit is vulnerable to a flaw where it may be tricked into performing file actions using special file inodes instead of the expected regular files. This behavior can lead to blocked operations or, in environments with rootful workers , potentially allow unintended host device access . No speci...

CVE-2026-93320 BuildKit improperly handles special files in build snapshots

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access...

CVE-2026-86671

In Eclipse Che versions 7.29.0 and later, the GET /api/scm/resolve and POST /api/factory/resolver endpoints pass an attacker-controlled URL to URLFetcher.fetch, which calls new URLurl.openConnection with no scheme or host allow-list and returns the response body to the caller. Any authenticated C...

CVE-2023-49545

CVE-2023-49545 Customer Support System 1.0 - Énumération de répertoires Description : Une vulnérabilité d'énumération de répertoires dans Customer Support System v1 permet à des attaquants de lister les répertoires et les fichiers sensibles de l'application sans nécessiter...

CVE-2025-9491_POC

CVE-2025-9491 PoC d'obfuscation de LNK Un outil de preuve de concept pour démontrer la vulnérabilité des fichiers raccourcis Windows LNK ZDI-CAN-25373/CVE-2025-9491. Cet outil montre comment des arguments de ligne de commande malveillants peuvent être cachés dans des fichiers .lnk en exploitant u...

WordPress WP Migration Plugin DB & Files – WP Synchro plugin <= 1.16.1 - 2FA Bypass vulnerability

2FA Bypass vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Migration Plugin DB & Files – WP Synchro versions = 1.16.1...

Dirty-Pipe-CVE-2022-0847

Dirty-Pipe-CVE-2022-0847 CVE-2022-0847 Dirty Pipe est une vulnérabilité d'écrasement arbitraire de fichier qui permet d'élever les privilèges en modifiant ou en écrasant des fichiers en lecture seule arbitraires, par ex. /etc/passwd, /etc/shadow. Étapes 1. Compilez en utilisant gcc...

tvsz

CVE-2018-6389 PoC node js multisite с прокси Этот скрипт основан на CVE-2018-6389, довольно коварной проблеме WordPress, которую, к сожалению, вероятно, не исправит команда разработчиков платформы, несмотря на то, что она известна уже давно. !!! ВАЖНО ПРЕЖДЕ ЧЕМ ПРОДОЛЖИТЬ !!! Весь репозиторий и...

CVE-2023-30367-mRemoteNG-password-dumper

mRemoteNG = v1.77.3.1784-NB Дампер паролей CVE-2023-30367 Multi-Remote Next Generation Connection Manager mRemoteNG — это бесплатное программное обеспечение, позволяющее пользователям хранить и управлять конфигурациями многопротокольных подключений для удаленного подключения к системам. Файлы...

CVE-2002-0347

CVE-2002-0347 Vulnérabilité de traversée de répertoire dans Cobalt RAQ 4 permettant à des attaquants distants de lire des fichiers protégés par mot de passe, et éventuellement des fichiers hors de la racine web, via un « .. » point point dans une requête HTTP. Publication Packetstorm à l'adresse...

Path Traversal

Apache Jena Fuseki is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of file paths, where the server fails to properly restrict directory traversal in request handling and attackers can craft malicious ../ sequences to read arbitrary files on the system...

BIT-PYTHON-2026-12345 Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick, specifically in the code file coders/hdr.c. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, resulting in values that are outside the range of the type unsigned char. This likely leads to a disruption in the...

Astra Linux – Vulnerability in liblivemedia

Live555 version 1.08 has a memory leak in the AC3AudioStreamParser for AC3 files...

Astra Linux – Vulnerability in imagemagick

A flaw was discovered in ImageMagick’s MagickCore/resize.c file. An attacker who submits a crafted file processed by ImageMagick could trigger undefined behavior, specifically a division by zero in mathematics. This likely results in a disruption to the application’s functionality, but it may als...

Astra Linux – Vulnerability in FontForge

Splinefont in FontForge, with a version number of 20230101, allows for command injection through crafted archives or compressed files...

Astra Linux – Vulnerability in Python-Django

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with appropriately crafted file names...

Astra Linux – Vulnerability in Thunderbird, Firefox

An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages. This bug only affects Thunderbird for Linux. Other operating systems are unaffected.. This vulnerability affects Firefox 108, Firefox ESR 102.6, and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the context of dm-verity-target.c, there is a potential way to modify read-only files due to a missing permission check. This could lead to a local escalation of privileges, as System execution privileges are required. User interaction is not necessary for exploiting this vulnerability. Produc...