CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100706 kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100706

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100692 Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme or module checked into themes/ or a vendored module could contain a symlink at a mount root for example themes/mytheme/assets -...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100684

Budibase versions 3.41.0 before 3.45.0 are vulnerable to an authentication bypass in the @budibase/server OIDC/SSO login path. The flaw exists in sso.authenticate because the server identifies pending user invites using only the IdP-asserted email address without validating an invite code or chec...

CVE-2026-100676

The media proxy/embed service of stoatchat (stoatchat/stoatchat) before version 0.15.5 contains a vulnerability where it improperly resolves SVG values as local filesystem paths when a fetched resource is served as image/svg+xml . An unauthenticated remote attacker can exploit this via the /prox...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100637 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

CVE-2026-100638

SiYuan versions before v3.8.4 are vulnerable to a path traversal flaw in the setNotebookIcon endpoint. Authenticated administrators can exploit this by supplying directory traversal sequences in the notebook parameter to escape the workspace data directory. This allows for the creation of arbitra...

CVE-2026-100637 SiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

EUVD-2026-87731

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

EUVD-2026-87732

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...

CVE-2026-100638 SiYuan before v3.8.4 Path Traversal via setNotebookIcon

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...

CVE-2026-100638 SiYuan before v3.8.4 Path Traversal via setNotebookIcon

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrators to create arbitrary directory trees and write files outside the workspace boundary. Attackers can supply directory traversal sequences in the notebook...