Security update for go1.25

This update for go1.25 fixes the following issues Security issues: CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. CVE-2026-39817: cmd/go: "go tool pack" does not...

@ranfdev/deepobj has a Prototype Pollution vulnerability

Impact Prototype pollution is possible when property paths contain proto/constructor/prototype. The property path must not be exposed as user input...

CVE-2026-44633

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can...

CVE-2026-44592

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENTDISCOVERABLE=true the default, and the NixOS module default, anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has...

EUVD-2026-30371

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can...

EUVD-2026-30358

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View AV / database names without any HTML escape, then a render template uses raw strings.ReplaceAlltpl, "$avName", nodeAvName to embed the name in HTML before pushing to all clients via...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to insufficient path sanitization in the osfs.ChrootOS component. An attacker can gain unauthorized access to unintended filesystem locations by supplying crafted paths containing directory traversal sequences...

CVE-2026-41935 Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init repeatedly invokes permission on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin...

CVE-2026-41933

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...

CVE-2026-41933 Vvveb < 1.0.8.3 Directory Listing Information Disclosure

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset path...

WS-2020-0044

decompress in all its versions is vulnerable to arbitrary file write. the package fails to prevent an extraction of files with relative paths which allows attackers to write to any folder in the system...

WS-2019-0313

There is an Unauthorized File Access vulnerability found in all versions of node-git-server. Attacker may access private repositories by using absolute paths...

WS-2019-0308

There is a Path Traversal vulnerability found in all version of f-serv. Because of insufficient sanitazion in URLs, attacker may access server files by use of relative paths while files fetching...

WS-2019-0238

serve versions before 10.1.2 are vulnerable to Path Traversal when Explicitly ignored folders can be accessed through relative paths,...

WS-2019-0153

yjmyjmyjm all versions has Directory Traversal vulnerability when resolving relative file paths...

Pode 路径遍历漏洞

Pode is an open-source framework developed by Badgerati for PowerShell ecosystems, aimed at cross-platform web and API development. Versions of Pode from 2.4.0 to 2.13.0 contained a path traversal vulnerability. This vulnerability stemmed from static routing, which allowed requests to include...

PT-2026-41023

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.18.0 OpenImageIO versions prior to 3.1.13.0 Description An issue exists in the toolset used for reading, writing, and manipulating image files for VFX and animation. Specifically, the softimageinput.cpp file...

PT-2026-41019

Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read. The endpoint accepts arbitrary chat object fields, so the user can...

The vulnerability of the data collection tool for Azure Monitor Agents from virtual machines and physical servers arises from improper external management of file names or paths. This allows attackers to escalate their privileges.

The vulnerability of the data collection tool for Azure Monitor Agents, which are associated with virtual machines and physical servers, is related to incorrect external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to increase their privileges...

The vulnerability of Microsoft Word text editors arises from improper external control of file names or file paths, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Microsoft Word relates to improper external management of file names or file paths. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...