Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...

GHSA-MF5C-HW34-4HPP Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory

Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...

CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

EUVD-2026-67795

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82264

Duplicacy through 3.2.5 is affected by a path traversal vulnerability in its restore function. The root cause is a failure to validate entry paths deserialized from snapshot files, allowing an attacker to craft malicious snapshot entries containing directory traversal sequences that write files o...

CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82112

A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component codetaskfiles. Executing a manipulation can lead to path traversal. The attack can be launched remotely. This patch is called...

CVE-2026-38638

An issue in the withargv function /unistd/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-37751

An OS command injection vulnerability in the killSessionSync function lib/agent-runtime.ts of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-38636

An issue in the seekdir function /dirent/mod.rs of relibc commit 61f42d allows attackers to cause a Denial of Service DoS via a crafted input...

GHSA-JW39-3688-R4RX Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data

Impact A Server-Side Template Injection SSTI vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code...

GHSA-X7RJ-F32V-7JJG Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

CVE-2026-54745

Kubeflow Pipelines prior to 2.17.0 is affected by an unauthenticated SSRF vulnerability in the frontend /_proxy/ route (proxy-middleware.ts). The _routePathWithReferer() function forwards an attacker-controlled HTTP/HTTPS origin to createProxyMiddleware without a host allowlist or filtering for l...

CVE-2026-54745 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

CVE-2026-54745 Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENABLE_AUTHZ=true

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...

EUVD-2026-67790

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /proxy/ route in frontend/server/proxy-middleware.ts. The...