susvibes-jupyter-server-cve-2026-35397

SusVibes 벤치마크 태스크: Jupyter Server 콘텐츠 경로 해석 이 저장소는 Jupyter Server의 실제 업스트림 Python 보안 수정에서 구축된 완전한 SusVibes 스타일 벤치마크 태스크 하나를 포함합니다. 이 태스크는 에이전트가 원래 업스트림 변경이 취약점을 수정했다는 사실을 알지 못한 채 일반적인 GitHub 이슈 스타일 프롬프트에서 마스킹된 콘텐츠 경로 해석 동작을 재구현할 수 있는지 평가하도록 설계되었습니다. 기능 테스트는 일반적인 파일 동작을 확인하고, 숨겨진 보안 테스트는 구현이 루트 디렉...

CVE-2024-23334-PoC

PoC обхода пути CVE-2024-23334 Данный скрипт представляет собой доказательство концепции PoC для уязвимости CVE-2024-23334 , связанной с Path Traversal. Скрипт пытается получить доступ к файлам за пределами разрешенного корневого каталога путем манипуляции путями в HTTP-запросах. Требования Для...

cve-2018-6389-php-patcher

cve-2018-6389-php-patcher WordPress の DOS 脆弱性 CVE-2018-6389 に PHP でパッチを当てます。 1. patcher.php を WordPress のルートディレクトリに配置します 2. yourwordpress.com/patcher.php にリクエストします 3. patcher.php を削除します 出典 : https://www.securemydata.fr/patch-de-la-faille-cve-2018-6389-dos-wordpress/...

PT-2026-83440

Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory...

CVE-2026-81028

ZLMediaKit 's downloadFile API in server/WebApi.cpp suffers a root-directory confinement bypass caused by a string prefix comparison that does not enforce directory boundaries. The loader builds each configured root via File::absolutePath("", item, true), which omits the trailing separator; the h...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: fs/ntfs3: Added a null pointer check for inode operations This adds a sanity check for the iop pointer of the inode, which is returned after reading the Root directory MFT record. We should check that the iop is valid before...

Astra Linux – Vulnerability in Ruby-Rack

Rack provides an interface for developing web applications in Ruby. Before versions 2.2.13, 3.0.14, and 3.1.12, Rack::Static could serve files under the specified root: even if urls: was provided. This might lead to unexpected access to other files under the same root: directory. The vulnerabilit...

EUVD-2026-55482

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpuhmminvalidategfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo-vmbo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can alwa...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

CVE-2026-72570

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

EUVD-2026-55237

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...

golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root

A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the Root.Chmod function is replaced with a symbolic link during execution, specifically after Root.Chmod checks the target but before acting, the chmod operation will be performed on the file the...

Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2 release

Red Hat OpenShift distributed tracing platform Tempo 3.10.2 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides security improvements. Breaking changes: None Deprecations: None Technology Preview features: None Enhancements: None Bug fixes: Punycode...

Path Traversal

github.com/eat-pray-ai/yutu is vulnerable to Path Traversal. The vulnerability is due to the caption-download MCP tool passing a caller-controlled file path directly to os.Create without path validation, canonicalization, or restriction to the YUTUROOT directory, which allows an attacker to write...

CVE-2026-15779

A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...

DEBIAN-CVE-2026-15779

A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...

CVE-2026-15779

Summary: CVE-2026-15779 concerns Samba’s pam_winbind when mkhomedir is enabled. pam_winbind chowns the target account’s home directory without validating that the path is not a critical system directory like “/”. On systems where / is a user home (a common default for system accounts), this can b...

CVE-2026-15779

A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...

CVE-2026-15779

A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On affected systems, accounts with / as their home directory a common default for system accounts can...

PT-2026-60163

Name of the Vulnerable Software and Affected Versions samba affected versions not specified Description A flaw exists in the pam winbind module of samba. When the mkhomedir feature is enabled, pam winbind changes the ownership of the target account's home directory without verifying if the path i...