144493 matches found
CVE-2026-92419 IDOR in WEBCON BPS
WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection
Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...
EUVD-2026-84802
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection...
vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App
Adobe has identified 9 vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App. These vulnerabilities are present in Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. The vulnerabilities concern various security issues in Adobe Connect, including SQL injection,...
USN-8806-1 network-manager vulnerability
It was discovered that NetworkManager did not properly restrict the ca-path and phase2-ca-path certificate authority settings for private single-user 802.1X network connections. An attacker could use this issue to point their own private 802.1X connection profile at a directory under their contro...
CVE-2026-15358
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...
RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
Summary uncbv extract writes each archive entry to outputdir.joinentryfilename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...
CVE-2026-53940
A flaw was found in Conda, a system-level binary package and environment manager. An unvalidated entry-point command in a noarch:python package's metadata allows a malicious package to use path traversal. This enables writing files outside the intended installation directory or overwriting existi...
Path Traversal
Http4s is vulnerable to a Path Traversal.The vulnerability is due to improper validation of URL path segments after percent-decoding, which allows an attacker to use encoded slash or backslash separators to traverse parent directories and access classpath or WebJar resources outside the configure...
EUVD-2026-85237
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
CVE-2026-15358
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions prior to 12.8.671 are susceptible to an unauthorized Path Traversal vulnerability. This flaw allows for unauthorized access to restricted file system paths. Specific exploitation details and links are not provided in the d...
CVE-2026-15358 Path Traversal Vulnerability
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
CVE-2026-15358 Path Traversal Vulnerability
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
CVE-2026-93987
A flaw was found in rclone. The rclone serve docker volume plugin contains a path traversal vulnerability. A highly privileged attacker, by submitting a crafted Docker VolumeDriver.Create request with a malicious volume name, can cause the rclone plugin process to create a directory and mount a...
CVE-2026-93986
A flaw was found in rclone. This path traversal vulnerability allows a remote attacker to craft special names in server and third-party listing responses. These crafted names, containing directory traversal sequences, could potentially enable writing outside the intended destination directory...
AZL-106830 CVE-2026-79616 affecting package qtdeclarative 6.6.1-2
Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path...