24135 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-72204
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: centalize $INDEXROOT header validation Add a dedicated helper to perform stricter validation of $INDEXROOT and use it for both directory inodes and named...
Linux Distros Unpatched Vulnerability : CVE-2026-72207
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntfs: not change 0-byte $DATA attribute to non-resident When ntfsresidentattrresize cannot grow a resident attribute in place, it retries after converting other...
K000162928: Node.JS vulnerability CVE-2026-58043
Security Advisory Description A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under --permission, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended...
CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
EUVD-2026-58650
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72836
Affected: FileBrowser before 2.63.19. Root on a case-insensitive filesystem (e.g., Windows/NTFS) allows two self-registered usernames that differ only by case to resolve to the same home directory, because the scope-ownership check uses an exact case-sensitive comparison. This enables an attacker...
CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72836
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
GO-2024-2617 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2025-3793 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5415 vulnerabilities
Vulnerabilities for packages: minio...
GO-2026-4896 vulnerabilities
Vulnerabilities for packages: minio...
GO-2022-0368 vulnerabilities
Vulnerabilities for packages: juicefs...
GO-2026-4806 vulnerabilities
Vulnerabilities for packages: juicefs...
GO-2026-5607 vulnerabilities
Vulnerabilities for packages: goreleaser...
GO-2025-4181 vulnerabilities
Vulnerabilities for packages: caddy...
CVE-2026-48099
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...