Fortinet FortiMail Path Traversal / NULL Byte Arbitrary File Write (FG-IR-26-175)

The version of FortiMail installed on the remote host is affected by a path traversal vulnerability as referenced in the FG-IR-26-175 advisory. - An improper limitation of a pathname to a restricted directory 'Path Traversal' combined with an improper neutralization of NULL byte or NULL character...

EUVD-2026-91675

uv: Path traversal on Windows through wheel extraction...

uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

EUVD-2026-90363

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...

GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

GHSA-2MJX-QC3C-RQVC Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is tha...

Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

NPM: Nx: Path traversal in nx migrate package-migrations extraction

NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

NPM: vm2: NodeVM custom resolution bypasses external path boundaries

NPM: vm2: NodeVM custom resolution bypasses external path boundaries vulnerability discovered by ? in WordPress Npm vm2 versions = 3.12.1...

GHSA-7G7C-H8RR-7P6Q Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...

GHSA-RVM3-566M-V7FV Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path

Impact Capacitor's WebView navigation guard validated only the host and scheme of a target URL, not its path. Because the internal HTTP proxy path /capacitorhttpinterceptor is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed...

CVE-2026-105751

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...

EUVD-2026-92815

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...