147901 matches found
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060
The rebar3 build tool (versions 3.7.0-rc1 to 3.27.2 ) contains a Path Traversal vulnerability (CWE-22) caused by unvalidated dependency app names. Because the rebar_packages:parse_deps/1 function fails to validate the app field from the Hex registry, a malicious publisher can provide a path such ...
EUVD-2026-97510
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-103060 Path traversal in rebar3 via unvalidated dependency app names
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-102597
Impact On some endpoints, Synapse will accept extraneous suffix data on the path of some endpoints. When Synapse is protected by a reverse proxy such as Nginx and the reverse proxy normalises paths when routing e.g. by converting "/a/../b" to "/b" for routing purposes, this can lead to a bypass o...
CVE-2026-96612
The hexpm hex package manager is vulnerable to a path traversal vulnerability (CWE-22) affecting versions 0.6.0 before 2.5.2 . The root cause is the lack of validation on the app label retrieved from the signed registry. A malicious publisher can provide a label containing traversal sequences (e....
CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
EUVD-2026-97508
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-96612
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
EEF-CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names
Summary Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package...
CVE-2026-96612 Path traversal in Hex via unvalidated dependency app names
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
CVE-2026-96612
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. A package release's...
[SECURITY] [DLA 4831-1] libgit2 security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4831-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 12, 2026 https://wiki.debian.org/LTS -...
CVE-2026-107378
A flaw was found in CairoSVG. A remote attacker can cause a Denial of Service DoS by providing a specially crafted Scalable Vector Graphics SVG file containing paths with numerous segments. Inefficient path processing leads to excessive CPU resource consumption during rendering, causing the...
CVE-2026-103535
Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...
CVE-2026-103537
Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The checkTemplate validation restricts relative directory traversal sequences such as ../ but does not reject absolute paths, allowing an authorized user to...