147504 matches found
CVE-2026-109956
NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...
CVE-2026-77361
The obsidian-tc Model Context Protocol server (prior to version 1.3.1 ) contains a vulnerability where a mismatch between lexical vault-relative paths (used for ACL checks ) and resolved paths (used for containment checks) allows for ACL bypass . An attacker can use an out-of-band-planted symlink...
CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list ACL checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied...
CVE-2026-77361 obsidian-tc symlink path mismatch bypasses read ACL restrictions
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list ACL checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an allowed glob that resolves into a denied...
CVE-2026-109965
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.ispathinproject normalizes paths lexically without resolving symlinks, so file tools like readfile and...
Windows SmartScreen Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network...
Dynamics Business Central Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in Dynamics Business Central allows an authorized attacker to elevate privileges over a network...
WebDAV Elevation of Privilege Vulnerability
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network...
Skype for Business Elevation of Privilege Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network...
Skype for Business Remote Code Execution Vulnerability
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network...
Microsoft Office SharePoint Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...
Windows Shell Elevation of Privilege Vulnerability
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally...
Servicing Stack Updates Elevation of Privilege Vulnerability
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally...
Windows Update Elevation of Privilege Vulnerability
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally...
Windows Backup Engine Elevation of Privilege Vulnerability
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally...
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...
Windows Setup Files Cleanup Elevation of Privilege Vulnerability
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...
Windows Encrypting File System (EFS) Information Disclosure Vulnerability
Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to disclose information over a network...
Microsoft Office SharePoint Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...