CVE-2026-75104 Hugging Face Transformers Path Traversal via Checkpoint Index

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

EUVD-2026-60384

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-75104: Improper Limitation of a Pathname to a Restricted Directory

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-73605 SiYuan before v3.7.4 Path Traversal via getUniqueFilename

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

PT-2026-71433

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A path traversal issue exists in the 'getUniqueFilename' endpoint. This allows anonymous readers to probe the filesystem without validation or confinement by supplying arbitrary absolute paths. This c...

CVE-2026-73605: Missing Authorization

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

Exploit for CVE-2026-41177

CVE-2026-41177: Squidex CMS Blind SSRF Technical research and...

Code Injection in flatcore/flatcore-cms

Description Bypass of remote code execution in https://github.com/flatCore/flatCore-CMS/issues/59 The following payload uses . for concatenation and to execute system commands. Proof of Concept 1 Insert the following as Permalink value lol".whoamipwned.txt." 2 Go to...