CVE-2026-44943 remote limited file-write as root via discovery in open-iscsi

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-44943 remote limited file-write as root via discovery in open-iscsi

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-29509

A flaw was found in Patool. A remote attacker could exploit a path traversal vulnerability in the safeextract function by providing a specially crafted archive. This vulnerability arises because a helper function uses an insecure comparison method, allowing malicious paths to bypass security...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-64400

A flaw was found in the Linux kernel's ksmbd component. A vulnerability in the ksmbd component allows a remote authenticated attacker to bypass path restrictions. Specifically, a bug in the caseless retry logic during path resolution fails to properly handle directory traversal attempts. This...

Exploit for CVE-2026-52832

CVE-2026-52832-PoC-exploit-nuclei-dashboard Nuclio Dashboard...

Exploit for CVE-2026-52832

CVE-2026-52832-PoC-exploit-nuclio-dashboard Nuclio Dashboard...

CVE-2026-58177

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-56390

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-56390 Arbitrary Output Location Change in GNU Bison

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

CVE-2026-56390

GNU Bison is affected by CVE-2026-56390 through grammar-defined output directives (%output, %header), which can accept unrestricted file paths and override caller-supplied output options. When processing attacker-supplied grammar, this allows writing generated files to arbitrary writable location...

CVE-2026-58177 Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-58177 Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-58177

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-58177 Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-58177

The CVE-2026-58177 entry describes memory-safety issues in the Apache Traffic Server Cripts framework, including out-of-bounds writes, path traversal, and use-after-free errors affecting 10.0.0–10.1.3. The issue is mitigated by upgrading to version 10.1.4, which fixes the vulnerability. The conne...

EUVD-2026-50222

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue...

CVE-2026-18192

VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

SUSE-SU-2026:22978-1 Security update for openssh

This update for openssh fixes the following issues: - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled server bsc1271044. - CVE-2026-59996: scp: file placed in the parent directory of an intended target...

CVE-2026-18192

VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...