CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

EUVD-2026-63899

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77751

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

CVE-2026-59323

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of service DoS due to unbounded object allocation when extracting incoming baggage headers. Micrometer Tracing 1.7.0 Micrometer Tracing 1.6.0 - 1.6.6 Micrometer Tracing 1.5.0 - 1.5.12...

CVE-2026-77751

CVE-2026-77751 is a path traversal vulnerability in the misp-stix library, affecting MISP object template name handling during STIX 2 import and MISP-to-STIX 2 export . Object names from untrusted content were not sufficiently validated before being used to construct a filesystem path for loading...

CVE-2026-77751

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

EUVD-2026-63877

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

PT-2026-79352

Name of the Vulnerable Software and Affected Versions misp-stix affected versions not specified Description A path traversal issue exists in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. The system constructs a filesystem path by joining the configured...

PT-2026-79479

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 3.2.3 Description Combodo iTop is a web based IT service management tool. The software allows a user without assigned write permissions to lock an object. Recommendations Update to version 3.2.3...

CVE-2026-33047: Missing Authorization

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3...

CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

Linux Distros Unpatched Vulnerability : CVE-2026-77587

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Tor before 0.4.9.11 is prone to a use-after-free and potential double free of a conflux object when a recovery leg revives a conflux set whose last linked leg h...

PT-2026-82326

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description An authenticated S3 principal with permissions limited to a nested object key can overwrite an object outside their assigned scope. This occurs when calling the PutObjectAcl function on a permitted...