CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93710

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

UBUNTU-CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

EUVD-2026-84258

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93712 Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93712

The Dancer2 framework (versions 2.1.0 before 2.2.0 ) for Perl is vulnerable to a directory traversal flaw in the File route handler . The handler fails to collapse relative path segments, allowing an unauthenticated request to escape the public_dir using sequences like /../outside.txt or percent-...

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93710

Dancer2 versions 2.0.0 through 2.1.x for Perl are vulnerable to an improper cleanup issue during exception handling in compile_hooks. When a hook dies and fires core.app.hook_exception, the system initiates a cleanup process. If the exception handler halts the response without stopping this clean...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl are vulnerable to a path traversal-like issue in the AutoPage handler. The vulnerability exists because the handler compares the request path against the layout directory name as plain text, but the subsequent lookup canonicalizes the path. Attackers can use...

CVE-2026-93709 Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

EUVD-2026-84244

A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was...

PT-2026-96324

Name of the Vulnerable Software and Affected Versions Dancer2 versions 2.0.0 through 2.1.x Description An issue exists where a route is dispatched even if a dying hook refused it, occurring when the exception handler halts the response in compile hooks. When a hook dies, it triggers core.app.hook...

PT-2026-96323

Name of the Vulnerable Software and Affected Versions Dancer2 versions prior to 2.2.0 Description The AutoPage handler serves a layout as a page when an equivalent spelling of its path bypasses the guard. This occurs because the handler compares the request path against the layout directory name ...

PT-2026-96715

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the Screenshot Handler component within the static content function of the changedetectionio/flask app.py file. A remote attacker can exploit thi...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

CVE-2026-43643: Missing Authorization

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...