Databricks Mosaic Research Composer path traversal vulnerability

Databricks Mosaic Research Composer version 0.32.1 has a path traversal vulnerability. This vulnerability arises from the tarball.extractall function in the Composer/utils/checkpoint.py file, which allows for path traversal when operating on the Checkpoint Extraction component. Attackers can...

Digital-Infrastructure path traversal vulnerability in Yisheng Software

Versions 9.6.5 through 9.6.11 of the Digital-Infrastructure software contain a path traversal vulnerability. This vulnerability stems from path traversal in the fileManager Y9FileController.retrieveFileStream handler. Unauthenticated attackers can exploit this by providing a parent directory path...

Siemens .NET Client Library for SIMATIC S7 Webserver API path traversal vulnerability

The Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61 has a path traversal vulnerability. This vulnerability stems from the failure to properly validate the file names received from the remote server during ticket downloads. As a result, path traversal is possible,...

CVE-2026-85953

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are vulnerable to path traversal and privilege management flaws within privileged legacy InfoStudio modules. The root cause is the insufficient validation of user-controlled file paths and user-context values. Successful...

EUVD-2026-97515

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution...

CVE-2026-85953 Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution...

CVE-2026-85953 Path traversal and privilege management flaws in Progress MarkLogic Server InfoStudio

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStudio modules that do not sufficiently validate user-controlled file paths and user-context values. Exploitation could result in unauthorized access to server files or execution...

CVE-2026-102595

Impact For some HTTP request paths, Synapse will ignore extraneous path segments and therefore serve a resource at an unexpected path. This could allow evasion of external rate-limiting that may be in place. The Client-Server API "/matrix/client", Federation API "/matrix/federation", Synapse Admi...

EEF-CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

The rebar3 build tool (versions 3.7.0-rc1 to 3.27.2 ) contains a Path Traversal vulnerability (CWE-22) caused by unvalidated dependency app names. Because the rebar_packages:parse_deps/1 function fails to validate the app field from the Hex registry, a malicious publisher can provide a path such ...

EUVD-2026-97510

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-102597

Impact On some endpoints, Synapse will accept extraneous suffix data on the path of some endpoints. When Synapse is protected by a reverse proxy such as Nginx and the reverse proxy normalises paths when routing e.g. by converting "/a/../b" to "/b" for routing purposes, this can lead to a bypass o...

CVE-2026-96612

The hexpm hex package manager is vulnerable to a path traversal vulnerability (CWE-22) affecting versions 0.6.0 before 2.5.2 . The root cause is the lack of validation on the app label retrieved from the signed registry. A malicious publisher can provide a label containing traversal sequences (e....

CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...