32 matches found
SUSE CVE-2026-114109
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted consolescripts or guiscripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories,...
CVE-2026-104082
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...
CVE-2026-104082 SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...
EUVD-2026-95887
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary FileStore root path inside the trusted...
PT-2026-108953
Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A remote code execution issue exists where an attacker with a SysAdmin-scoped access token can bypass Volume Mount script-directory containment. This is achieved by provisioning a new mail...
CVE-2026-84810 claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
EUVD-2026-70225
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
CVE-2026-84810 claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
PT-2026-84828
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
CVE-2026-84810: Protection Mechanism Failure
claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python source, bytecode, and other artifacts in the scripts directory. Attackers can distribute skills with malicious code in non-manifest files that receive a SAFE...
Linux Distros Unpatched Vulnerability : CVE-2019-7653
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code...
VulnCheck KEV: CVE-2021-23263
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/ non-binary...
Command Injection
Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Command Injection via the flashgot API and the download process. An attacker can execute arbitrary code by manipulating the download path to target the...
PYSEC-2024-302
pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...
PYSEC-2024-302
pyLoad is a free and open-source Download Manager. The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be...
PT-2023-30657
Name of the Vulnerable Software and Affected Versions pyLoad version 0.5.0 Description The issue allows an authenticated user to upload files to arbitrary locations on the server, potentially leading to command execution by abusing scripts. When creating a new package, a subdirectory is created...
Crafter CMS FreeMarker Read
The vulnerability of /scripts/, /templates/, and /.git/ in the Crafter CMS content management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to read the textual content through FreeMarker remotely...
CVE-2021-23263
Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/ non-binary...
DEBIAN-CVE-2019-7653
The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts...
CVE-2019-7653
The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code injection, because "python -m" looks in this directory, as demonstrated by rdf2dot. This issue is specific to use of the debian/scripts...