Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105751 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

CVE-2026-105748

The Docling library (versions 2.16.0 through 2.131.0 ) is vulnerable because the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs during serialized DoclingDocument input validation. When processing with ImageRefMode.EMBEDDED , the Docli...

CVE-2026-105748 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

CVE-2025-60876

CVE-2025-60876: busybox wget request-target injection fix A behavior-preserving fix for CVE-2025-60876, an HTTP header-injection vulnerability in BusyBox wget, plus the proof-of-concept that demonstrates it and the artifacts for submitting the fix upstream to BusyBox. The vulnerability BusyBox wg...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-102262

Newell Brands DYMO ID version 1.5.1.71 is vulnerable to a path traversal issue due to improper spheres of control. The software resolves its plugin Modules directory relative to the process working directory. An attacker can place a malicious job file and DLLs in a directory, then set the process...

CVE-2026-102262 Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim clicks on the file, resulting in code...

CVE-2026-105766

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

CVE-2026-105766 Chainguard Academy (edu) Nginx directory redirect downgrades HTTPS requests to HTTP

Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy edu from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0e50739c225f5aee2e803800a47fc0feb906 allows an on-path network attacker to read or modify documentatio...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-105683

The Ghost Node.js content management system is vulnerable to a path traversal vulnerability (CWE-35) in the ImageSize Service . Affected versions range from 6.14.0 until 6.27.0 . Due to an input validation issue, authenticated staff users could access local files outside of the intended data stor...

CVE-2026-105683 Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0...

CVE-2026-90378

A flaw was found in the Linux kernel's mt76 wireless driver, specifically in the mt792x SDIO TX path. When the txprepareskb function fails to prepare a socket buffer skb for transmission, the skb is not properly released. This memory leak can lead to resource exhaustion, potentially causing a...