CVE-2026-109274 ImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is...

CVE-2026-109274

ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vulnerability that allows attackers to bypass the path security policy when executing a magick script. Attackers can swap a checked path with a symlink during script execution to read files that the security policy is...

CVE-2026-109254 FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path

FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the static rdpsnd channel disconnect path, which frees audio formats and device without joining playthread. A malicious RDP server can disconnect while asynchronous Wave2 playback processes queued PDUs, causing the client to...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

EUVD-2026-97691

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP versions before 3.32.0 are vulnerable to a path traversal flaw in the convert_filedescriptors_to_file_list() function located in winpr/libwinpr/clipboard/synthetic_file.c. The vulnerability occurs because the software concatenates server-supplied cFileName values from FileGroupDescriptorW...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247 FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109247

FreeRDP before 3.32.0 contains a path traversal vulnerability in convertfiledescriptorstofilelist in winpr/libwinpr/clipboard/syntheticfile.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or...

CVE-2026-109245 FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD...

Natural Language Toolkit path traversal vulnerability

NLTK versions 3.10.3 and earlier have a path traversal vulnerability. This vulnerability arises from WekaClassifier not verifying the model path. Attackers can bypass the nltk.pathsec restriction by controlling the modelfilename or model parameter, allowing for path traversal. This may result in...

Fortinet FortiSIEM path traversal vulnerability

Fortinet FortiSIEM versions 7.5.0, 7.4.0 to 7.4.2, 7.3.0 to 7.3.5, 7.2.0 to 7.2.7, 7.1.0 to 7.1.9, and 7.0.0 to 7.0.4 have a path traversal vulnerability. This vulnerability stems from improper restrictions on path names for restricted directories during path traversal. It may allow attackers to...

Polaris Office App path traversal vulnerability

The Polaris Office App version 9.9.19 has a path traversal vulnerability. This vulnerability stems from the incorrect handling of the displayname parameter in the Document Intake component’s function com.infraware.service.m.n.a, which may allow local attackers to perform path traversal attacks...

Siemens .NET Client Library for SIMATIC S7 Webserver API path traversal vulnerability

The Siemens .NET Client Library for SIMATIC S7 Webserver API versions prior to 3.3.61 has a path traversal vulnerability. This vulnerability stems from the failure to properly validate the file names received from the remote server during ticket downloads. As a result, path traversal is possible,...

Databricks Mosaic Research Composer path traversal vulnerability

Databricks Mosaic Research Composer version 0.32.1 has a path traversal vulnerability. This vulnerability arises from the tarball.extractall function in the Composer/utils/checkpoint.py file, which allows for path traversal when operating on the Checkpoint Extraction component. Attackers can...

James Bardin: A Python SCP module with path traversal vulnerabilities

James Bardin’s Pure Python SCP module versions 0.16.1 and earlier have a path traversal vulnerability. This vulnerability stems from issues with the recvfile/recvpushd functions in the SCP Receive Handler component, which allow for path traversal attacks by remote attackers...

Quasar Framework path traversal vulnerability

Quasar Framework versions 2.22.0 to 2.23.3 had a path traversal vulnerability. This vulnerability stemmed from the dir and filename parameters in the SSG page definitions returned by getSsgPages in @quasar/app-vite. These parameters were concatenated with build.distDir without proper validation o...

Seldon MLServer path traversal vulnerability

Seldon MLServer versions 1.6.1 and earlier have a path traversal vulnerability. This vulnerability stems from improper handling of the extractenv function in the environmenttarball Handler component. It may lead to path traversal attacks, and attackers can launch these attacks remotely...

Stone Wu Path Traversal Vulnerability

Stone Wu’s Rongguang versions 1.2.0 and earlier have a path traversal vulnerability. This vulnerability stems from the subDir parameter in the POST /api/storage/upload request, which allows for path traversal. The LocalStorageStrategy.storeBytes function does not normalize the sequence of parent...