144982 matches found
CVE-2026-53940
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
EUVD-2026-83974
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940
Conda versions prior to 26.5.2 are vulnerable to a path traversal during noarch:python package installation. The function parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a package's info/link.json metadata, which was then interpolated into the...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...
EUVD-2026-83973
File owners were unable to unlock TYPETOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database...
Security Bulletin: Impacted IBM Optim 1.0.0 and 1.2.0 by vulnerability in go.opentelemetry.io/otel/sdk
Summary IBM Optim versions 1.0.0 and 1.1.0 include open-source package go.opentelemetry.io/otel/sdk which is affected by a high-severity vulnerability. IBM Optim 1.2.0 resolves this vulnerability by upgrading the affected open-source package to a fixed version. Vulnerability Details...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in plexus-utils, OpenSSL, jose4j, Go net/url, and Apache Hadoop
Summary IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 include open-source packages plexus-utils, OpenSSL, jose4j, Go net/url, and Apache Hadoop that are affected by five vulnerabilities ranging from high to medium-high severity, including path traversal, stack buffer overflow, denial-of-service via...
Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) images by vulnerabilities in github.com/caddyserver/caddy/v2 package
Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark images by vulnerabilities in github.com/caddyserver/caddy/v2 package. IBM Optim 1.2.0 resolves these vulnerabilities by upgrading the affected open-source dependencies to fixed versions. Vulnerability Details CVEID:CVE-2026-27587 DESCRIPTION:...
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...
Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities
Summary Several vulnerabilities were found in DataStage on Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-82101 DESCRIPTION: DataStage on Cloud Pak for Data could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. CWE:CWE-22: Imprope...
efivar: efivar: Denial of Service due to stack overflow in device path node parsing
A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for an EFI Extensible Firmware Interface device path node header. A local user could exploit this...
Important: Red Hat Security Advisory: Red Hat Data Grid 8.6.3 security update
An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
webpack-dev-middleware: webpack-dev-middleware: Information Disclosure via Path Traversal
A flaw was found in webpack-dev-middleware. A remote attacker can exploit a path traversal vulnerability when the configured publicPath lacks a trailing slash. By sending a specially crafted request, the attacker can bypass a security guard, allowing the middleware to resolve files from one...
RUSTSEC-2026-0296 `unzip` is unmaintained
The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...
`unzip` is unmaintained
The unzip crate has only ever released a single version, 0.1.0 published 2017-12-23, and has seen no further activity. It appears to be unmaintained, and its known path-traversal "zip-slip" vulnerability will not be fixed. Consider migrating to an actively maintained alternative such as zip...
Security Bulletin: IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
Summary IBM Financial Transaction Manager FTM has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-18173 DESCRIPTION: IBM Financial Transaction Manager FTM could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS...
CVE-2026-66835
A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...
