CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 OS Command Injection via merge function

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

CVE-2020-37279

The easy-pdf-merge library, versions 0.1.0 through 0.2.6 , is vulnerable to an OS command injection vulnerability. The flaw exists because the software fails to properly sanitize shell metacharacters—such as double quotes, semicolons, $(), or backticks—when processing the source path , destinatio...

EUVD-2020-31276

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

CVE-2020-37279

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $ ...

CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84320

Nginx UI , a web user interface for the Nginx web server, is vulnerable to a path traversal vulnerability in versions prior to 2.4.3 . The root cause lies in the AutoBackup.GetName function, which returns a user-controlled name without rejecting path separators or parent-directory components. Thi...

CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84320

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-81493

Summary The fix for CVE-2026-48769 GHSA-f6m5-xw2g-xc4x, commit "46d6ef23", present in v7.2.0 added "validate.IsSHA256fp" but gated it to "protocol == "direct"" only. A project user with "EntitlementCanCreateImages" can "POST /1.0/images" with "source.protocol=simplestreams" or "incus"/"lxd"/"oci"...

CVE-2026-81500

Summary The "incus" CLI, when exporting or copying an image from a remote server into a directory target, takes the local filename verbatim from the server-controlled "Content-Disposition: filename=" for UNIFIED images and passes it into "os.Renametmp, filepath.Jointarget, resp.MetaName" with no...

CVE-2026-81495

Summary "POST /1.0/storage-pools//volumes" with an "application/octet-stream" body custom-volume ISO or backup import uses an attacker-controlled name as an on-disk path segment without validation. A project user with the "cancreatestoragevolumes" entitlement can supply "X-Incus-name: ../../../.....

CVE-2026-81496

Summary "POST /1.0/instances" with an "application/octet-stream" body instance backup import reads the instance name from the tarball's "backup/index.yaml" verbatim and uses it as an on-disk path segment. A project user with the "cancreateinstances" entitlement can set "name:...

CLSA-2026-1791833994 TuxCare security update for path-to-regexp (1 CVE)

TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.10-tuxcare.2...

CVE-2026-103061

A flaw was found in gleam. When downloading dependencies, the build tool uses the application name from package metadata to determine the build directory path without validating it. A malicious package publisher can supply path traversal sequences or an absolute path, causing arbitrary directorie...

CVE-2026-59976

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-102663

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath...

CVE-2026-104102

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-103061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

CVE-2026-102663

Prior to version 4.2.4 , OpenList is vulnerable to unauthorized disclosure of file metadata and existence information due to a non-separator-aware path check in the search API. When Bleve search is enabled, an authenticated user with restricted access can exploit a flawed strings.HasPrefix compar...