103550 matches found
DragonForce Ransomware Abused Microsoft Teams to Hide Malware Activity
DragonForce ransomware abused Microsoft Teams relay systems to hide a custom backdoor, steal files and encrypt systems at a US services firm...
EUVD-2026-37871
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content...
CVE-2026-44942 libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content...
CVE-2026-44942 libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content...
CVE-2026-44942
CVE-2026-44942 affects libzypp: a path traversal in handling the "path" component of .repo files could allow writing outside the zypp cache. The issue affects the 17.x series (before 17.38.13) and before 16.22.19. OpenSUSE Tumbleweed/ SUSE advisories indicate this vulnerability is fixed in libzyp...
CVE-2026-44942 libzypp .repo files can have an optional path which can lead to path traversal attacks
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content...
OPENSUSE-SU-2026:21137-1 Security update for perl-Crypt-PasswdMD5
This update for perl-Crypt-PasswdMD5 fixes the following issues: Changes in perl-Crypt-PasswdMD5: - updated to 1.430.0 1.43 see /usr/share/doc/packages/perl-Crypt-PasswdMD5/Changelog.ini V 1.43 Date=2026-05-23T08:14:00 Deploy.Action=Upgrade Deploy.Reason=Security Comments= EOT - Accept pull reque...
SUSE CVE-2026-53705
A flaw was found in GStreamer's WavPack audio decoder in gst-plugins-good. When processing a specially crafted WavPack file, an integer overflow in the buffer size calculation 4 blocksamples channels in gstwavpackdechandleframe causes a very small heap allocation. The WavPack library then writes...
Cleartext Storage of Sensitive Information
Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the process that handles service bindings from VCAPSERVICES containing TLS client credentials. An attacker can access sensitive private key material by reading temporary files created with...
PT-2026-50712
Name of the Vulnerable Software and Affected Versions Webmin affected versions not specified Description Unauthenticated attackers can read the contents of any file ending in .conf within module directories. This is caused by a bypassable regex pattern, which is a sequence of characters used to...
PT-2026-61773
Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description An unauthenticated attacker can read arbitrary files on the server by providing an absolute filesystem path in the agent file field of the Jobs API. The system lacks path validation and an...
PT-2026-61799
Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The multiedit tool in src/praisonai/praisonai/tools/multiedit.py allows arbitrary file read and write operations because it lacks path validation, workspace boundary checks, and protected...
PT-2026-51526
Name of the Vulnerable Software and Affected Versions GPAC MP4Box version 2.4 Description A NULL pointer dereference exists in the gf isom add track kind function within the isomedia/isom write.c file. This issue allows a remote attacker to trigger a Denial of Service DoS by processing a speciall...
The vulnerability of SINEC INS network infrastructure management software, due to deficiencies in path name checking for the catalog, allows attackers to gain unauthorized access to protected information.
The vulnerability of the SINEC INS network infrastructure management software is related to deficiencies in checking the path name when processing the final endpoint /api/sftp/uploadFiles. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...
Splunk Enterprise Missing Authentication for Critical Function Vulnerability
Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint...
PT-2026-50823
Name of the Vulnerable Software and Affected Versions armeria-xds versions 1.38.0 through 1.39.0 Description DataSourceStream in the xDS module resolves filename and environment variable fields from SDS Secret resources without an allow-list or base-directory confinement. This allows a compromise...
PT-2026-50672
UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability...
PT-2026-61764
Name of the Vulnerable Software and Affected Versions praisonai versions 3.9.24 through 4.6.57 Description The CODE TOOLS wrappers in PraisonAI Code fail open when a workspace boundary is not explicitly set. If an application utilizes CODE TOOLS, code read file, code search replace, or code apply...
(0Day) Ashlar-Vellum Cobalt STP File Parsing Type Confusion Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing o...