142846 matches found
CVE-2026-84842
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...
CVE-2026-84421
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...
CVE-2026-102810
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...
CVE-2026-102242
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Related public issue context, not a duplicate Closed issue 1429 "Handle non-UTF-8 paths", 2024-03-24 raised exactly this general concern and even suggested detection via pregmatch'//u', $path !== 1 -- note the reporter's suggested check explicitly compares !== 1, which would correctly treat PCRE'...
GHSA-253C-MCHW-3W2R markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Summary Two independent quadratic paths in the linkify: true handling. Both are in markdown-it's own code rather than in linkify-it, which stays linear on both payloads. src/rulescore/linkify.ts calls arrayReplaceAt once per linkified text token, and that rebuilds the whole children array each...
CVE-2026-84421 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...
CVE-2026-84421 DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...
CVE-2026-84421
IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote code execution because of improper path validation during archive extraction . This flaw, categorized under CWE-22: Path Traversal , allows a remote authenticated attacker to execute arbitrary code. To remediate this vulnerabilit...
CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...
CVE-2026-84842 IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...
CVE-2026-84842
IBM Guardium Data Protection 12.2 is susceptible to a path traversal and arbitrary file deletion vulnerability within the Datasource REST component . An authenticated remote attacker can exploit this flaw to delete files, which may result in a denial of service or compromise system integrity . No...
EUVD-2026-89188
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...
CVE-2026-102722
The FTP Client is vulnerable to a flaw in the IPv4 PASV path where it accepts any address provided in the server's 227 reply . Because validation only ensures the address parses correctly and contains non-zero values, a malicious server can specify an arbitrary address to redirect the client. No ...
CVE-2026-102722
In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...
CVE-2026-102242
The Google MCP Toolbox for Databases (versions 1.2.0 through 1.9.0 ) is vulnerable to a path traversal flaw due to improper link resolution (CWE-59 / CWE-22 ) in the allowedLocalRoots path validation. Because the system performs lexical path validation without first resolving symbolic links , a r...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
CVE-2026-102810 Marmite through 0.4.2 Path Traversal via Development Server
Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...