CVE-2026-51134

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-51134: Improper Limitation of a Pathname to a Restricted Directory

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-91200

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-91144

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-91200

DevSpace versions through 6.3.21 contain a path traversal vulnerability in the in-pod sync stream's tar extraction logic. The tool fails to reject parent-directory segments in tar entry names, allowing an attacker operating a malicious container to stream tar entries with traversal sequences that...

CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-91200 DevSpace through 6.3.21 Path Traversal via tar extraction

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

RamziRange10

🕶️ RamziRange10 A deliberately vulnerable web application en...

Security Bulletin: IBM Virtualization Engine TS7700 is susceptible to multiple vulnerabilities in Python.

Summary IBM Virtualization Engine TS7700 is susceptible to two Tampering conditions and one potential Elevation of Privilege issue due to the use of Python CVE-2025-0938, CVE-2025-47273, CVE-2025-1795. TS7700 uses Python to perform operations with the Cloud and internal system configuration tasks...

CVE-2026-86886

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...

CVE-2026-84598

A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with physical access to a trust-paired device may be able to read and write arbitrary files...

CVE-2026-84568

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-53713

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

CVE-2026-84568

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

EUVD-2026-77878

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-84568

A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges...

CVE-2026-84568

A path traversal vulnerability exists in the autofs / automountd component on macOS Tahoe 26.6 and earlier . The issue stems from automountd failing to validate whether the host component of a map entry (from LDAP, NIS, or OpenDirectory) resolves to the local machine. This allows a malicious dire...

CVE-2026-86886

Apple has addressed a path traversal vulnerability affecting iOS , iPadOS , and watchOS . The root cause was a lack of proper input validation, which could allow an application to modify protected system files . This issue is resolved in iOS 26.7 , iPadOS 26.7 , iOS 27 , iPadOS 27 , and watchOS 2...

EUVD-2026-78015

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...