The vulnerability of the platform for creating individual web applications in CRM involves an incorrect restriction on the path to the catalog, allowing attackers to delete arbitrary files.

The vulnerability of the platform for creating individual web applications in CRM involves incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to delete arbitrary files remotely...

The vulnerability of the iFlightDoc onboard documentation system, related to incorrect restrictions on the path name to the catalog, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the iFlightDoc onboard documentation system is related to an incorrect limitation on the name of the path to the catalog h. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the protected information...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs — это легковесный и самостоятельно размещаемый Git-сервис, аналогичный приватной версии GitHub, предназначенный для простого запуска на серверах с низкими ресурсами. Уязвимость CVE-2025-8110 — это критическая ошибка безопасности, которая позволяет атакующему обойти...

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

Impact The Git node validated the repository that a fetch or pull targeted, but setUpstream wrote a branch..remote value into the repository's own configuration without validating it. A subsequent fetch or pull resolved the remote from that configuration rather than from the checked parameter, so...

NPM: n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

NPM: n8n: Git Node branch..remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

CVE-2024-40725

HTTP Request Smuggling 감지 도구 이 저장소는 HTTP Request Smuggling 취약점을 탐지하는 Python 기반 도구를 포함하며, 특히 CVE-2024-40725를 대상으로 합니다. 이 도구는 조작된 HTTP 요청을 보내고 서버의 응답을 분석하여 Apache HTTP Server에서 이 취약점을 악용하려고 시도합니다. 주된 목표는 특정 경로에 대한 제한을 우회하는 등 상태 코드나 접근 동작의 차이를 식별하는 것입니다. 기능 HTTP Request Smuggling 취약점 탐지 단일 URL 테스트 및...

CVE-2026-86995 n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote...

CVE-2025-15693

The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate...

PT-2026-86316

🚨 CVE-2025-15693 The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to...

CVE-2026-82020

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

CVE-2026-82020

Hermes Agent versions 0.16.0 through prior to 0.17.0 contain an improper path restriction vulnerability. Sensitive-path guards that should protect the credential store failed to exclude the auth.json file , allowing an attacker who can influence ingested message content to craft a malicious messa...

EUVD-2026-67866

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

PT-2026-83283

Name of the Vulnerable Software and Affected Versions Hermes Agent version 0.16.0 Description An improper path restriction exists that allows attackers who can influence ingested message content to overwrite the credential store. This occurs by bypassing sensitive-path guards that failed to exclu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: pcp (UTSA-2026-093148)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093148 advisory. A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUS...

SUSE-SU-2026:23223-1 Security update for open-iscsi

This update for open-iscsi fixes the following issues: Update to version 2.1.12.suse+0.8f77cf16: - CVE-2026-44943: improper limitation of pathname to a restricted directory allows remote MITM attackers to create root-owned files outside the database and inject lines into records bsc1268353. -...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

EUVD-2026-54412

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

The vulnerability of the ImageMedium::watermark() function in the Grav CMS system allows a hacker to disclose protected information.

The vulnerability of the ImageMedium::watermark function in the Grav CMS system is related to an incorrect limitation on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...