143683 matches found
EUVD-2026-87980
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101051
Cloudreve versions prior to 4.16.1 are vulnerable to a path traversal flaw during remote downloads. The application fails to properly sanitize file paths returned by remote downloaders, which allows authenticated users to exploit path traversal sequences in downloader metadata. This enables an at...
CVE-2026-101051 Cloudreve before 4.16.1 Path Traversal via Remote Download
Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations withi...
CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CVE-2026-101044
The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and
EUVD-2026-87975
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...
CLSA-2026-1790520007 TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.10-tuxcare.1...
Exploit for Path Traversal in Jenkins
\ CVE-2024-23897 — Jenkins CLI Arbitrary File Read Lab \ 1...
CVE-2026-97164
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
Exploit for CVE-2026-87902
CVE-2026-87902 — WordPress Core Unauthenticated Local File Inc...
CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
EUVD-2026-87931
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
CVE-2026-97164
The Event Gallery extension for Joomla (developed by svenbluege.de ) versions
CVE-2026-97164 Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in clear cache task in Event Gallery extension 6.5.0 - Using the images parameter of the cache.process task, you can recursively delete any directories that the web server is authorized to write to...
Updated erlang package fixes security vulnerabilities
SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...
CVE-2026-100854
AzuraCast before 0.23.6 lacks RequireInternalConnection middleware on the Liquidsoap API endpoint and incorrectly derives the AutoDJ flag from header presence rather than validated value. Users with View station permission can inject arbitrary now-playing metadata, disrupt live broadcasts, and...