141176 matches found
EUVD-2026-91675
uv: Path traversal on Windows through wheel extraction...
GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction
Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...
EUVD-2026-90363
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...
GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...
GHSA-2MJX-QC3C-RQVC Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is tha...
Nx: Path traversal in nx migrate package-migrations extraction
Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...
EUVD-2026-91761
Nx: Path traversal in nx migrate package-migrations extraction...
GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction
Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...
NPM: Nx: Path traversal in nx migrate package-migrations extraction
NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...
vm2: NodeVM custom resolution bypasses external path boundaries
Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...
NPM: vm2: NodeVM custom resolution bypasses external path boundaries
NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...
GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries
Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...
CVE-2023-1177
CVE-2023-1177 | | اجتياز مسار MLFlow | تم اختباره على MLflow 2.2.0 | src: https://github.com/iumiro/CVE-2023-1177-MLFlow | .. code-block:: bash !/bin/bash RAND="EXPLOIT-$1+$RANDOM%9999" URL="http://172.17.0.2:6001" FILE='/root/.ssh/idrsa' curl -vX POST...
CVE-2024-23774
CVE-2024-23774 - ثغرة مسار خدمة ويندوز غير مقتبس سيتم تقديم المعلومات في الوقت المناسب...
CVE-2019-17234b-Exploit
ثغرة في إضافة Wordpress IgniteUp إضافة Wordpress IgniteUp الإصدار 3.4 وما دونه تسمح للمستخدمين غير المصادق عليهم عن بُعد بحذف أي ملف بشكل تعسفي على خادم الويب المستهدف مما قد يسبب هجوم حجب الخدمة Denial of Service. الجدول الزمني لـ CVE-2019-17234 تم إبلاغ فريق wordpress.org بالثغرة في 20 سبتمبر...
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...
GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...
GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...
CVE-2026-105751
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...