CVE-2026-121549

The nnn utility (versions through 5.3 ) is vulnerable to an insecure temporary file symlink overwrite in its pdfread and nuke plugins. The root cause is the use of predictable paths in the /tmp directory for temporary files. A local attacker can pre-create a symlink at a name-derived or PID-deriv...

CVE-2026-117183

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2026-119364

A flaw was found in ProFTPD. An authenticated remote attacker can bypass write restrictions and overwrite files in protected locations due to a symbolic link symlink following flaw in the modcopy module. By creating a symlink in a writable directory pointing to a restricted target, an attacker ca...

CVE-2026-117183

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

PT-2026-133625

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2026-117183

The astro-notion-blog framework (versions 0.6.1 to 0.13.0) contains a Path Traversal vulnerability in the FeaturedImage component, specifically within the downloadFile() function of src/lib/notion/client.ts. The root cause is the use of decodeURIComponent() on remote image URLs without sufficient...

CVE-2026-117183

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

EUVD-2026-114179

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2025-22238

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory...

CVE-2026-107042

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

Security Bulletin: IBM MQ Console is affected by a relative path traversal vulnerability (CVE-2026-78254)

Summary IBM MQ Console has addressed a relative path traversal vulnerability Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the...

CVE-2026-107042

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

EUVD-2026-113271

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

CVE-2026-107042

The USP Ultimate Screenshot Painter application (version 240213.009 ) is affected by CVE-2026-107042 , which stems from insecure permissions (CWE-732). This vulnerability allows an unauthorized attacker to move or overwrite files within another user's private storage by providing a crafted conten...

CVE-2026-107042

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

CVE-2026-107042: n/a: Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or…

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

PT-2026-132341

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI...

USP Ultimate Screenshot Painter security vulnerability

Version 240213.009 of USP Ultimate Screenshot Painter contains a security vulnerability stemming from insecure permission settings. Unauthorized attackers can exploit this flaw by providing a specially crafted content URI to move or overwrite files within another user’s private storage...

CVE-2026-118038 Path Traversal in Telerik Document Processing Libraries AI Agent Tools

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to...