CVE-2026-68527: Authorization Bypass Through User-Controlled Key

Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog concrete/controllers/dialog/event/edit.php. The dialog checked permissions against the calendar identifier supplied in the request rather than the calendar owning the targeted eve...

CVE-2026-79781: Improper Limitation of a Pathname to a Restricted Directory

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2021-34718

A vulnerability in the SSH Server process of Cisco IOS XR Software could allow an authenticated, remote attacker to overwrite and read arbitrary files on the local device. This vulnerability is due to insufficient input validation of arguments that are supplied by the user for a specific file...

CVE-2006-4013: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Symantec Brightmail AntiSpam SBAS before 6.0.4, when the Control Center is allowed to connect from any computer, allow remote attackers to read and overwrite certain files via directory traversal sequences in 1 DATABLOB-GET and 2 DATABLOB-SAVE...