64040 matches found
ROOT-APP-PYPI-CVE-2026-42305 CVE-2026-42305 in dulwich - Patched by Root
Root has patched CVE-2026-42305 in the dulwich package for Root:PyPI. Multiple fixed versions available...
ROOT-OS-ALPINE-322-CVE-2025-70873 CVE-2025-70873 in sqlite - Patched by Root
Root has patched CVE-2025-70873 in the sqlite package for Root:Alpine:3.22. Multiple fixed versions available...
CVE-2026-72583
A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...
CVE-2026-72570
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
CVE-2026-72567
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
EUVD-2026-55223
A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...
EUVD-2026-55230
A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...
CVE-2026-72570
CVE-2026-72570 affects the project cube-root/directory-serve up to version 1.3.7. The vulnerability is a stored XSS : uploading a file with a crafted filename containing HTML attribute-breaking characters allows the attacker to inject arbitrary JavaScript into the web interface. The root cause is...
CVE-2026-72570
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
EUVD-2026-55237
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
CVE-2026-72569 cube-root directory-serve - Unauthenticated Path Traversal Arbitrary File Deletion
A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to delete arbitrary files outside the intended served directory when the application is run with the --delete option...
CVE-2026-72569
The CVE-2026-72569 entry describes a path traversal vulnerability in cube-root/directory-serve
CVE-2026-72567
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
CVE-2026-72567
The CVE-2026-72567 entry concerns AsyncFuncAI/deepwiki-open. A path traversal flaw arises from improper validation in the wiki-cache API endpoint (api/api.py) which builds file paths from user-controlled owner, repo, and repo_type fields, allowing unauthenticated remote actors to write to or dele...
EUVD-2026-55239
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete
An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...
CVE-2026-66408
The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account...