EUVD-2026-93568

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Impact When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath into the manifest without validating that it is a safe package-relative file reference. An attacker can supply...

CVE-2026-105795

The Kiota OpenAPI-based HTTP Client code generator versions 1.25.1 through 1.35.0 are vulnerable to an improper limitation of pathnames (CWE-22 ). The software fails to validate the x-ai-capabilities.response_semantics.oauth_card_path value when copying it from an attacker-controlled or compromis...

EUVD-2026-42399

asyncssh has SCP Path Traversal to Arbitrary File Write...

Updated opam packages fix security vulnerability

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...

MGASA-2026-0116 Updated opam packages fix security vulnerability

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory. CVE-2026-41082...

PYSEC-2026-2134

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when...

CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when...

CVE-2026-34726 Copier `_subdirectory` allows template root escape via parent-directory traversal

Copier is a library and CLI app for rendering project templates. Prior to version 9.14.1, Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when...

Copier `_subdirectory` allows template root escape via parent-directory traversal

Summary Copier's subdirectory setting is documented as the subdirectory to use as the template root. However, the current implementation accepts parent-directory traversal such as .. and uses it directly when selecting the template root. As a result, a template can escape its own directory and ma...

PT-2024-30555

Name of the Vulnerable Software and Affected Versions CraftOS-PC 2 versions prior to 2.8.3 Description The issue allows users of CraftOS-PC 2 on Windows to escape the computer folder and access files anywhere without permission or notice by obfuscating ..s to bypass the internal check preventing...

CVE-2024-43395: Improper Limitation of a Pathname to a Restricted Directory

CraftOS-PC 2 is a rewrite of the desktop port of CraftOS from the popular Minecraft mod ComputerCraft using C++ and a modified version of PUC Lua, as well as SDL for drawing. Prior to version 2.8.3, users of CraftOS-PC 2 on Windows can escape the computer folder and access files anywhere without...