AZL-94695 CVE-2026-66484 affecting package cpio 2.14-1

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

DEBIAN-CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

UBUNTU-CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-72577

NASA fprime-gds (through version 3.4.3) contains multiple vulnerabilities that collectively allow unauthenticated remote code execution on the ground station host and the ability to inject commands into connected spacecraft. The Flask application (src/fprime_gds/flask/app.py) applies no authentic...

EUVD-2026-55229

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72572

The CVE concerns o1lab/xmysql (all versions) with a path traversal vulnerability in lib/xapi.js: lines 338 and 424 use user-supplied req.query.name in path.join(cwd, name) and pass it to res.download() without sanitization, enabling unauthenticated remote attackers to read/download arbitrary serv...

CVE-2026-72572 o1lab xmysql - Unauthenticated Path Traversal via name Query Parameter

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

EUVD-2026-55234

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

CVE-2026-72572

A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...

CVE-2026-72571

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

CVE-2026-72571 mustafaakin cast-localvideo - Unauthenticated Path Traversal via dir Parameter

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

CVE-2026-72571

The CVE-2026-72571 entry concerns mustafaakin/cast-localvideo (all versions). A path traversal vulnerability exists where app.js reads req.body.dir and passes it to res.sendFile() without sanitization (lines 151–153), enabling an unauthenticated remote attacker to read arbitrary server files via ...

EUVD-2026-55235

A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...

CVE-2026-72569 cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...

CVE-2026-72569

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...