CVE-2026-78886

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

CVE-2026-57863

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

EUVD-2026-65490

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...

CVE-2026-79622 dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversal

A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the component file-access-from-request Endpoint. Executing a manipulation of the argument outputFile/outputDir can lead to path traversal. It is possible to launch...

CVE-2026-79622

A path traversal vulnerability was identified in dekdee/adobe-xd-mcp version 1.0.0 , specifically in the file src/parsers/xd-parser.ts within the file-access-from-request Endpoint component. A remote attacker can manipulate the outputFile/outputDir argument to traverse the file system, leading to...

BIT-PYTHON-MIN-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...

CVE-2026-57863

Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

EUVD-2026-65478

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-78886

CVE-2026-78886 is a path traversal vulnerability in liketrek TREK (versions up to 3.0.22 ), affecting an unknown function within the file server/src/nest/journey/journey-public.controller.ts of the Public Journey Photo Proxy component. An unauthenticated remote attacker can exploit this with high...

EUVD-2026-65474

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

CVE-2026-78886 liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

CVE-2026-78886 liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated...

CVE-2021-41773

HTTP Apache Path Traversal NSE-Skript CVE-2021-41773 Beschreibung Dieses NSE-Skript prüft, ob ein Apache-HTTP-Server anfällig für die Path Traversal -Schwachstelle CVE-2021-41773 ist. Ein anfälliger Server ermöglicht es Angreifern, ohne Anmeldung auf Dateien zuzugreifen, auf die sie keinen Zugrif...

CVE-2026-57909

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...

python3.12 security update

An update is available for python3.12. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

python3.14 security update

An update is available for python3.14. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming languag...

CVE-2026-57909 WatchGuard Agent path traversal allows unauthenticated remote code execution

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...

CVE-2026-57909 WatchGuard Agent path traversal allows unauthenticated remote code execution

A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary code on an affected system...