173 matches found
FreeScout < 1.8.225 - Unauthenticated Maintenance File Existence Oracle
FreeScout before 1.8.225 exposes the maintenance endpoint /tools.php without authentication; different responses to existing and non-existing PHP paths disclose filesystem path existence before credential validation. id: CVE-2026-62850 info: name: FreeScout 1.8.225 - Unauthenticated Maintenance...
mariadb: MariaDB: Unauthorized table access via unencoded partition names
A flaw was found in MariaDB. When converting table partitions, the database server does not properly encode user-specified partition names before using them in filesystem path construction. An authenticated database user can exploit this issue by providing a specially crafted partition name to...
CVE-2026-102523
A flaw was found in MariaDB. When converting table partitions, the database server does not properly encode user-specified partition names before using them in filesystem path construction. An authenticated database user can exploit this issue by providing a specially crafted partition name to...
MariaDB Server input validation error vulnerability
A input validation error vulnerability exists in MariaDB Server versions from 10.11.1 up to and including 10.11.19, from 11.4.1 up to and including 11.4.13, from 11.8.1 up to and including 11.8.9, from 12.3.1 up to and including 12.3.3, and from 13.0.1 up to and including 13.0.2. This vulnerabili...
CVE-2026-121541 Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the...
CVE-2026-121541 Bake filesystem path entitlements approval can be skipped in some multi-target builds
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the...
CVE-2026-121542 Bake filesystem path entitlements approval can be skipped for path using basename prefix
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working...
CVE-2026-121542
In Docker Buildx versions v0.19.0 through v0.38.0 , a flaw allows untrusted Bake definitions to bypass filesystem entitlement checks. Specifically, paths under the same parent directory as the current working directory that use the working directory's basename as a prefix can expose files to the ...
CVE-2026-121542 Bake filesystem path entitlements approval can be skipped for path using basename prefix
In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working...
CVE-2026-119328 Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...
Keycloak Vulnerable To Information Disclosure Through Arbitrary Filesystem Path Probing
Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths,...
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths,...
GHSA-9JRW-8XF7-XQHQ Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths,...
CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...
Linux Distros Unpatched Vulnerability : CVE-2026-118485
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename...
PT-2026-133243
Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths,...
CVE-2026-109823 Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a...
CVE-2026-109823
The tidewave application (versions 0.8.0 before 0.9.2 ) is vulnerable to host filesystem path disclosure via DNS rebinding . Because responses to /tidewave/connect and the rendered toolbar do not verify the Host header , an attacker can use a web page that rebinds its domain to the loopback addre...
EEF-CVE-2026-109823 Host filesystem path disclosure via DNS rebinding
Summary An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag wi...
CVE-2026-109823 Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a...