111602 matches found
PT-2026-63567
Name of the Vulnerable Software and Affected Versions @fastify/static versions prior to 10.1.2 Description An unauthenticated attacker can bypass path-based filtering because the allowedPath callback is evaluated before the normalization of dot segments and duplicate path separators in the pathna...
Fedora 44 : perl-YAML-Syck (2026-2139aa7dce)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2139aa7dce advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...
PT-2026-63998
Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation in the font processing feature of the DataHub module allows unauthenticated attackers to read arbitrary files from the server...
PT-2026-64188
Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description A path traversal issue exists in the static file controller. Unauthenticated remote attackers can read arbitrary files, including system files and environment configuration files containing...
PT-2026-63997
Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the SVG processing feature within the DataHub module. This path traversal weakness allows unauthenticated attackers ...
Fedora 43 : perl-YAML-Syck (2026-c8484f1afb)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c8484f1afb advisory. This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load path on untrusted input with no special flags:...
PT-2026-63999
Name of the Vulnerable Software and Affected Versions Bold Reports Standalone Report Designer versions 6.3 through 14.1.11 Description A missing filepath validation issue exists in the database download feature within the DataHub module. This path traversal weakness allows unauthenticated attacke...
GHSA-W7X5-G22V-XQHR Eclipse Jetty: Path parameter traversal
Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...
Eclipse Jetty: Path parameter traversal
Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...
EUVD-2026-43647
Eclipse Jetty: Path parameter traversal...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter...
EUVD-2026-42357
LiteLLM: Arbitrary file write via path traversal in Skills archive extraction...
GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...
GHSA-PF2Q-PXHF-HGMW n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory
Impact The component @n8n/computer-use file-search tool confined searches to a configured base directory. A crafted search pattern could bypass the confinement check and expand to locations outside that directory, causing the tool to return the names and contents of files anywhere the daemon's OS...
External Control of File Name or Path
Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to External Control of File Name or Path via the Edit Image. An attacker can write arbitrary files outside the intended directory by supplying crafted values to the output format parameter. Workaround...
GHSA-G7HG-VRCF-MVMR Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
Summary OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Details In...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via improper validation of file paths in SVG images encoded as data-URI. An attacker can access arbitrary files from the server's filesystem by embedding a reference to a local file within a base64-encoded SVG image,...
GHSA-CX96-42PX-69FM Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
Description: An attacker, who controls the HTML input supplied to dompdf, can read arbitrary images from the server’s file system, bypassing the chroot restriction. The vulnerability is exploitable in the default configuration. Exploitation conditions: An external user Researcher: Nikita Sveshnik...
CVE-2026-64796
Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...