EUVD-2025-210857

ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentially crashing the process...

SUSE CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner's parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-14350

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

CVE-2026-14350

IBM Cloud Pak for Data System (CPDS 1.0), versions 11.3.0.2 through Interim Fix 1 , is vulnerable to log injection (CWE-117) caused by improper neutralization of special elements when writing to log files. An unauthenticated, remote attacker can inject data into log messages, resulting in low int...

EUVD-2026-71492

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-14350 Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

CVE-2026-14350 Vulnerabilities exists in IBM Cloud Pak for Data System

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

Security Bulletin: Watson Machine Learning on Cloud Pak for Data is affected by transformers(Publicly disclosed vulnerability) ( CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568)

Summary Watson Machine Learning on Cloud Pak for Data is affected by CVE-2024-11393, CVE-2024-11394, CVE-2024-11392, CVE-2024-12720, CVE-2024-3568 Vulnerability Details CVEID:CVE-2024-11393 DESCRIPTION: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code...

CVE-2026-75168

An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/...

CVE-2026-19303

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory...

CVE-2026-19306

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secretkey, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute pat...

CVE-2026-80806

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

CVE-2026-80806 ext4: don't enable DAX on new encrypted files

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4setinodeflagsinode, init=true in ext4newinode is made before EXT4INODEENCRYPT is set. As a result, it can set...

CVE-2026-85690

Plandex 2.2.1 is vulnerable to a path traversal in the ApplyFiles function, which allows files to be written outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to sensitive locations such as shell rc or cro...

CVE-2026-85668

Xinference (v3.x, affected commit 4a94832, specifically v3.3.0) contains an unauthenticated arbitrary-path file read vulnerability in the POST /v1/models/llm/auto-register endpoint. The endpoint accepts a caller-supplied model_path parameter without authentication or path confinement, reads and p...

EUVD-2026-71222

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawlparse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...

EUVD-2026-71001

SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks explicitly configured as Visible:false. Attackers with reader role can access private workspace files including notebook metadata and internal...

Symlink Path Traversal

NLTK is vulnerable to a symlink path traversal. The vulnerability is due to lexical path validation that does not account for symlink resolution, which allows a local attacker to place a symlink within the corpus root and access arbitrary files outside the intended corpus directory...

MAL-2026-15927 Malicious code in qoeoe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967 The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed 108 KB string literal and passes the...