142983 matches found
CVE-2026-107614: Integer Underflow (Wrap or Wraparound)
An integer underflow in WinCursorShapeUtils::trimTransparent in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to crash the server, and potentially read out-of-bounds memory, by causing a cursor shape with a width or height of zero to be processed on the DXGI...
CVE-2026-85487: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...
Power Automate for Desktop Privilege Escalation
The vulnerability of the Power Automate for Desktop automation platform is related to deficiencies in processing relative path entries in the catalog. Exploiting this vulnerability can allow attackers to enhance their privileges...
Visual Studio Code Path Traversal
The vulnerability of Visual Studio Code’s source editor is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...
EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)
According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...
Debian dla-4829 : rails - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4829 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4829-1 [email protected]...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8893-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8893-1 advisory. It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2...
MiracleLinux 8 : tar-1.30-13.el8_10 (AXSA:2026-1944:04)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1944:04 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X...
ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution...
CVE-2026-107377: Improper Limitation of a Pathname to a Restricted Directory
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...
Aruba ClearPass Policy Manager 6.14.x < 6.14.1 Path Traversal (HPESBNW05158)
The version of Aruba ClearPass Policy Manager installed on the remote host is 6.14.x prior to 6.14.1. It is, therefore, affected by a path traversal vulnerability as referenced in the HPESBNW05158 advisory. - An authenticated path traversal vulnerability exists in the command line interface of...
EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-3944)
According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...
Security Bulletin: Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Summary Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...
CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...
CVE-2026-105820
The Vault ACL policy cache is vulnerable to a path traversal flaw (CWE-22) when policy names contain specific traversal constructs. This allows a token with a specially crafted policy name to bypass namespace boundaries and utilize the capabilities of policies defined in other namespaces, includi...
CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...
Vault Enterprise ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution
Summary Vault’s ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...
GHSA-P944-4XH2-X776 Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...
