CVE-2026-109274

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is...

CVE-2026-109254 FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to...

EUVD-2026-97691

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP versions before 3.32.0 are vulnerable to a path traversal flaw in the convert_filedescriptors_to_file_list() function located in winpr/libwinpr/clipboard/synthetic_file.c. The vulnerability occurs because the software concatenates server-supplied cFileName values from FileGroupDescriptorW...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109245 FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD...

Siemens Industrial Edge Device Kit – arm64 Path Traversal Vulnerability

Siemens Industrial Edge Device Kit – There is a path traversal vulnerability in the arm64 version. This vulnerability stems from insufficient restrictions on access to internal APIs and paths by authenticated users. As a result, authenticated remote attackers may gain access to sensitive internal...

Seldon MLServer path traversal vulnerability

Seldon MLServer versions 1.6.1 and earlier have a path traversal vulnerability. This vulnerability stems from improper handling of the extractenv function in the environmenttarball Handler component. It may lead to path traversal attacks, and attackers can launch these attacks remotely...

James Bardin: A Python SCP module with path traversal vulnerabilities

James Bardin’s Pure Python SCP module versions 0.16.1 and earlier have a path traversal vulnerability. This vulnerability stems from issues with the recvfile/recvpushd functions in the SCP Receive Handler component, which allow for path traversal attacks by remote attackers...

Yosheng Software Digital-Infrastructure Path Traversal Vulnerability

The Yousheng Software Digital-Infrastructure version 9.6.5 to 9.6.11 contains a path traversal vulnerability. This vulnerability stems from the fileManager storeFile endpoint’s path traversal flaw. Unauthenticated attackers can create or overwrite service-writable files by sending specially craft...

Databricks Mosaic Research Composer path traversal vulnerability

Databricks Mosaic Research Composer version 0.32.1 has a path traversal vulnerability. This vulnerability arises from the tarball.extractall function in the Composer/utils/checkpoint.py file, which allows for path traversal when operating on the Checkpoint Extraction component. Attackers can...

Natural Language Toolkit path traversal vulnerability

NLTK versions 3.10.3 and earlier have a path traversal vulnerability. This vulnerability arises from WekaClassifier not verifying the model path. Attackers can bypass the nltk.pathsec restriction by controlling the modelfilename or model parameter, allowing for path traversal. This may result in...

Stone Wu Path Traversal Vulnerability

Stone Wu’s Rongguang versions 1.2.0 and earlier have a path traversal vulnerability. This vulnerability stems from the subDir parameter in the POST /api/storage/upload request, which allows for path traversal. The LocalStorageStrategy.storeBytes function does not normalize the sequence of parent...

Siemens Industrial Edge Cloud Device (IECD) path traversal vulnerability

The Siemens Industrial Edge Cloud Device IECD has a path traversal vulnerability. This vulnerability stems from inadequate restrictions on authenticated users accessing internal APIs and paths, potentially allowing authenticated remote attackers to access sensitive internal information and thus...

Quasar Framework path traversal vulnerability

Quasar Framework versions 2.22.0 to 2.23.3 had a path traversal vulnerability. This vulnerability stemmed from the dir and filename parameters in the SSG page definitions returned by getSsgPages in @quasar/app-vite. These parameters were concatenated with build.distDir without proper validation o...

Fortinet FortiSIEM path traversal vulnerability

Fortinet FortiSIEM versions 7.5.0, 7.4.0 to 7.4.2, 7.3.0 to 7.3.5, 7.2.0 to 7.2.7, 7.1.0 to 7.1.9, and 7.0.0 to 7.0.4 have a path traversal vulnerability. This vulnerability stems from improper restrictions on path names for restricted directories during path traversal. It may allow attackers to...