CVE-2026-64826

rConfig before 8.2.13 suffers a path traversal vulnerability in the download_export() method that allows authenticated attackers to read arbitrary files by unsafely handling directory traversal sequences in the filename GET parameter. Exploitable via crafted requests containing ../ sequences to e...

CVE-2026-13105

CVE-2026-13105 affects IBM i Access Client Solutions (ACS) versions 1.1.2.0–1.1.9.13. The vulnerability is a zip slip/path traversal issue that occurs when importing a configuration, arising from improper handling of archive paths. Impact is high (C:H/I:H/A:H) as per IBM’s CVSS vector, with netwo...

EUVD-2026-57611

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

CVE-2026-13105 IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration...

EUVD-2026-57610

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-68930 vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-M65R-RPRJ-R5RG vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-WP74-JGXH-GV4Q vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-G9HV-X236-4QP3 vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-M65R-RPRJ-R5RG vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-CQJC-RMPQ-XPRQ vulnerabilities

Vulnerabilities for packages: yazi...

GHSA-QVW7-JM5C-6HQW vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-50528 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-W7CW-XP7H-6J5J vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-74JP-VM22-8Q8X vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-73409

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient on Budibase Cloud. A builder could submit absolute server paths through /api/datasources/verify a...

CVE-2026-16033 Arbitrary file read+write on host via templates/ symlink in malicious image

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-16033

CVE-2026-16033 describes a path traversal vulnerability in LXD. When processing image metadata templates, LXD fails to sanitize or restrict template file paths from escaping the instance templates directory, specifically affecting VM/QEMU driver execution paths. An attacker can supply a crafted i...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-16033 Arbitrary file read+write on host via templates/ symlink in malicious image

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...