GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-77262

CVE-2026-77262 — Lettura arbitraria di file in mcp-atlassian tramite confluenceuploadattachment Gravità : Alta CVSS 8.6 CWE : CWE-22 — Path Traversal Componente interessato : sooperset/mcp-atlassian 0.22.0 Corretto in : 0.22.0 Advisory : GHSA-p6hp-93wp-fh6p NVD :...

CVE-2026-28995

CVE-2026-28995 Proof of Concept for CVE-2026-28995 — Path Traversal vulnerability in App Intents on iOS 26.4.2 and below. Description This vulnerability allows a malicious app to read any file outside its sandbox via App Intents. The root cause is insufficient path validation in Apple's App Inten...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2026-105748

The Docling library (versions 2.16.0 through 2.131.0 ) is vulnerable because the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs during serialized DoclingDocument input validation. When processing with ImageRefMode.EMBEDDED , the Docli...

CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile attraversamento del percorso Proof-of-concept eseguibili per riprodurre la stessa vulnerabilità Apache Camel, uno per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 +...

CVE-2025-60876

CVE-2025-60876: correzione dell'iniezione nel request-target di busybox wget Una correzione che preserva il comportamento per CVE-2025-60876, una vulnerabilità di iniezione di intestazioni HTTP in BusyBox wget, più la proof-of-concept che la dimostra e gli artefatti per inviare la correzione...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-102262

Newell Brands DYMO ID version 1.5.1.71 is vulnerable to a path traversal issue due to improper spheres of control. The software resolves its plugin Modules directory relative to the process working directory. An attacker can place a malicious job file and DLLs in a directory, then set the process...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2024-25293

MJML PoC zur lokalen Codeausführung Ein Proof-of-Concept für die Schwachstelle CVE-2024-25293. Es wurde festgestellt, dass mjml-app v3.0.4 & 3.1.0-beta eine Remote-Codeausführung RCE enthält. In diesem Repository befinden sich eine beispielhafte verwundbare Anwendung und ein...

CVE-2021-41773-Apache-2.4.49-

CVE-2021-41773-Apache-2.4.49- Penetration testing 1.1. Path Traversal Read /etc/passwd file !/bin/bash Script: exploitpathtraversal.sh Objective: Read /etc/passwd file from Apache 2.4.49 TARGETIP="128.0.0.100" URL="http://$TARGETIP/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd" echo "+ Exploiting...

CVE-2026-59310

CVE-2026-59310 More echo '1 2026-08-14T12:00:00.000Z ../../../../../../opt/vmware/share/htdocs/configurev2/cve59310chkee57b163c432 research - - - CVE-2026-59310-ee57b163c432'|nc syslogserver 514 GET /configurev2/cve59310chkee57b163c432-syslog.log HTTP/1.1...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...