UBUNTU-CVE-2026-62388

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

UBUNTU-CVE-2026-62385

NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and NKJPCorpusReader that allows attackers to parse XML files outside the corpus root by supplying unsafe selectors or poisoned index state. Attackers can exploit framebyname, doc, lu, and header methods wi...

CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile attraversamento del percorso Riproduzioni proof-of-concept eseguibili per la stessa vulnerabilità Apache Camel, una per runtime:...

CVE-2026-66907

CVE-2026-66907 — camel-google-storage downloadFileName Path Traversal Ausführbare Proof-of-Concept-Reproducer für dieselbe Apache-Camel-Schwachstelle, einer pro Laufzeitumgebung:...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile Pfad-Traversal Ausführbare Proof-of-Concept-Reproduktionen für dieselbe Apache-Camel-Schwachstelle, eine pro Laufzeitumgebung: Laufzeitumgebung| Verzeichnis| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 +...

CVE-2019-20085

📂 CVE-2019-20085 – Exploit di Directory Traversal per TVT NVMS-1000 a cura di Z3R0 Autore: Z3R0 CVE: CVE-2019-20085 Bersaglio: TVT NVMS-1000 tutte le versioni note precedenti alla patch Tipo di vulnerabilità: Directory Traversal senza autenticazione Data: Inserisci la tua data di rilascio 🔍...

Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

Ricognizione e Sfruttamento: Vulnerabilità del Server HTTP Apache - CVE-2021-41773 e CVE-2021-42013 In questo progetto, ho documentato un processo dettagliato di penetration testing mirato alle vulnerabilità del server HTTP Apache, in particolare CVE-2021-41773 e CVE-2021-42013, che coinvolgono...

CVE-2026-78435

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435 Faveo Helpdesk Logo SettingsController.php unlink path traversal

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CVE-2026-78435

A path traversal vulnerability exists in Faveo Helpdesk up to version 2.0.3 . The flaw is in the unlink function within app/Http/Controllers/Admin/helpdesk/SettingsController.php (component: Logo Handler ). Manipulation of the data1 argument allows an authenticated attacker (high privileges requi...

CVE-2026-5006

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile: Scrittura Arbitraria di File tramite Path Traversal CVE-2025-4517 CVSS 9.4 – Critico Una vulnerabilità nel modulo tarfile di Python che consente la scrittura arbitraria di file al di fuori della directory di estrazione quando si utilizza TarFile.extractall o...

EUVD-2026-65122

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

By-Poloss..-..CVE-2026-39938

CVE-2026-39938: Cacti = 1.2.30 - LFI non autenticato Riepilogo esecutivo Campo| Valore ---|--- CVE ID| CVE-2026-39938 Punteggio CVSS| 9.8 Critico Prodotto interessato| Cacti Versioni interessate| = 1.2.30 Versione corretta| 1.2.31 Commit di correzione| 9871f0c Dettagli della vulnerabilità Causa...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Security Bypass

Summary golang.org/x/crypto is used by IBM Storage Fusion Data Foundation, which could cause Security Bypass. CVE-2022-30636, CVE-2024-45337, CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181. Vulnerability Details CVEID:CVE-2022-30636 DESCRIPTION: httpTokenCacheKey uses path.Base to...

CVE-2026-71932

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to acce...

CVE-2026-34908-check

Script di rilevamento della catena RCE non autenticata su UniFi OS Server Un rilevatore sicuro per la catena di esecuzione remota di codice non autenticata in UniFi OS Server ≤ 5.0.6, divulgato in Ubiquiti Security Advisory Bulletin 064: CVE| Classe| Ruolo nella catena ---|---|--- CVE-2026-34908 ...

CVE-2026-77113

Traversal de Caminho no apport-unpack do Apport CVE-2026-77113 https://youtu.be/CdM1Xtnx0uQ Uma questão de traversal de caminho no apport-unpack do Apport permitia que chaves de relatório controladas pelo atacante escapassem do diretório de extração especificado. Um relatório criado contendo:...

CVE-2026-34910-unifi-poc

UniFi OS CVE Proof of Concept Proof of Concept für autorisierte Tests gegen zwei Pfade, die wie folgt identifiziert wurden: CVE-2026-34910: Auth-Bypass, der zu Command Injection und Remote Code Execution über den Handler für Paketupdates führen kann. CVE-2026-34909: Path Traversal, der zu...