2409 matches found
CVE-2026-17182
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments...
CVE-2026-17182
CVE-2026-17182 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments (CWE-287). The vulnerability has a high impact: CVSS v3.1 base score 9.8 (...
CVE-2026-17173
IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17173, a path-traversal vulnerability caused by improper validation of file paths that could allow a remote authenticated attacker to obtain sensitive information. Affected versions: 7.4, 7.5, 7.6. Remediation: apply IBM PTFs SJ10947 (7.4), SJ1...
CVE-2026-17173 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...
CVE-2026-72820
Grav prior to 2.0.13 is vulnerable to a backup profile path traversal issue. The root-path validation fails when a hard-coded deny-list is not applied, allowing attackers who have profile editor access to configure backup profiles with traversal paths that can archive or expose files from outside...
Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of GetFileWithoutZip method. The issue results from th...
google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...
CVE-2026-16898
CVE-2026-16898 affects IBM i 7.3–7.6 and can allow a local authenticated attacker to change ownership of arbitrary files due to improper validation of attacker-controlled file paths (CWE-73). The issue is documented in IBM’s Security Bulletin for Network Authentication Service, which confirms the...
EUVD-2026-58379
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...
CVE-2026-16898 IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...
GHSA-CQJC-RMPQ-XPRQ vulnerabilities
Vulnerabilities for packages: yazi...
Linux Distros Unpatched Vulnerability : CVE-2026-62992
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. Prior to 5.8.2 and 4.5.7 on the 4.x line,...
CVE-2026-16230
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...
EUVD-2026-56929
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...
CVE-2026-19091
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleterevision function in all versions up to, and including, 2.8.169. This makes it possible for...
CVE-2026-16230
The CVE concerns the Formidable Digital Signatures plugin for WordPress, where the delete_file function fails to validate file paths in all versions up to 3.0.6. This allows unauthenticated attackers to delete files on the server by submitting an attacker-controlled filename via item_meta[field_i...
CVE-2026-48056
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...
EUVD-2026-56148
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...
CVE-2026-48056
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...