75375 matches found
CVE-2026-53795: Improper Link Resolution Before File Access
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...
PT-2026-71658
Name of the Vulnerable Software and Affected Versions rsync versions 3.0.0 through 3.4.x Description An out-of-bounds write occurs when triggering HLINK BUMP processing on file entries that have the FLAG HLINKED flag set while the hard-link preservation option is inactive. This happens because th...
CVE-2026-19744: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...
ROS-20260813-73-0020
The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2026-15413: Hidden Functionality
The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key except for the health check...
CVE-2026-66464: Missing Authorization
Unauthenticated Broken Access Control in Internal Link Optimiser = 5.2.7 versions...
CVE-2026-12036: Improper Link Resolution Before File Access
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges...
CVE-2026-72849: Cross-Site Request Forgery (CSRF)
Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...
ROS-20260813-73-0011
The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...
PT-2026-71457
Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity url allowed filter that fails to block hex-encoded IPv4 addresses, IPv6 literals, and link-local ranges. Authenticated users with adminImagesAdd permission can bypass the filter using alternate addres...
Linux Distros Unpatched Vulnerability : CVE-2026-73584
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary...
PT-2026-71633
Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the --temp-dir or --link-dest options, whi...
CVE-2026-53795
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...
PT-2026-71619
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges...
VulnCheck KEV: CVE-2025-55583
D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a preapiarg parameter that is passed directly to system-level shell execution functions without...
ROS-20260813-73-0004
The vulnerability in Gitea is related to the use of a name with an incorrect link. Exploiting this vulnerability can allow an attacker to cause service failures...
CVE-2026-73420: Incorrect Behavior Order: Validate Before Canonicalize
NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...
CVE-2026-0291: Improper Link Resolution Before File Access
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS,...