54252 matches found
CVE-2026-17094
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...
CVE-2026-17094
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...
CVE-2026-17094
CVE-2026-17094 is a CWE-22 path traversal flaw in IBM i's Navigator for i component (versions 7.3–7.6), allowing a remote authenticated attacker to read sensitive files and manipulate arbitrary files on the system. IBM rates it CVSS 4.3 (MEDIUM) with low integrity impact; NVD rates it 7.1 (HIGH) ...
EUVD-2026-57353
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...
CVE-2026-17094 IBM i is Affected By Path Traversal Vulnerability in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...
CVE-2026-18106 IBM i is Affected By Multiple Vulnerabilities in Navigator for i
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...
CVE-2026-18106
IBM i (versions 7.3, 7.4, 7.5, 7.6) is affected by CVE-2026-18106: remote authenticated attacker could obtain sensitive information due to improper validation of user-supplied path input (path traversal). The incident is tied to Navigator for i in IBM i, with a base CVSS v3.1 score of 4.3 (Low co...
CVE-2026-18106
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...
EUVD-2026-57350
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...
CVE-2026-52776
creationtimestamp| type| source ---|---|--- 2026-08-12 16:35:03+00:00| published-proof-of-concept| https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-h47f-gmjp-m7rr...
CVE-2026-70427
A flaw was found in Jenkins. Attackers who can control agent processes can exploit this vulnerability by providing specially crafted .tar or .tar.gz archives to the Jenkins controller. This is due to unsafe handling of symbolic links with effectively empty names during archive extraction...
CVE-2026-66384
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...
External Control of File Name or Path
Overview SSH.NET is a Secure Shell SSH library for .NET, optimized for parallelism and with broad framework support. Affected versions of this package are vulnerable to External Control of File Name or Path via server-controlled SCP filenames through the recursive download path in...
GHSA-Q939-RPR3-3284 SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...
CVE-2026-73291
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...
CVE-2026-66382
An authenticated user may write files outside the intended Artifactory work directory under specific conditions...
CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...