202887 matches found
rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...
GHSA-66HP-WGXQ-6F5Q rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...
CVE-2026-81940
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-81940
CVE-2026-81940 affects IBM Langflow OSS versions 1.0.0 through 1.11.5 , where improper neutralization of special characters in flow display names permits a remote authenticated attacker to execute arbitrary code. The underlying cause is classified as CWE-94 (Code Injection) : attacker-controlled ...
CVE-2026-81940 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace
rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...
CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...
CVE-2026-64837 ICEcoder through 8.1 OS Command Injection via lib/properties.php
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...
PT-2026-89636
šØ CVE-2026-81940 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. š@cveNotify...
CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...
EUVD-2026-74949
Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...
multer vulnerable to Denial of Service via crafted multipart field names
Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...
multer vulnerable to Denial of Service via oversized array index in field names
Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...
python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
A flaw was found in python-cryptography. This vulnerability arises from incorrect handling of wildcard Domain Name System DNS names during certificate validation. Specifically, the verifier may accept a certificate with a broad wildcard DNS name e.g., .example.com even when a more restrictive nam...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86484
In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86499
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
EUVD-2026-72515
In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission...
CVE-2026-86499
JetBrains YouTrack before version 2026.1.14047 contained an information disclosure flaw in its predefined search fields , which leaked all group names to any user regardless of their visibility permissions. The vulnerability is rated CVSS 4.3 (Medium) with a network attack vector, low complexity,...