CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

EUVD-2026-97882

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559

EdgeEver Desktop versions 1.6.26 through 1.112.0 are vulnerable to a navigation allowlist bypass caused by insufficient string-prefix URL matching . Attackers can exploit this by embedding a link using userinfo syntax after the dev-server prefix—for instance, within a note-template preview—to loa...

PT-2026-110935

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-109559: Incorrect Authorization

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to...

CVE-2026-92812: Improper Limitation of a Pathname to a Restricted Directory

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete...

CVE-2026-48785

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-48785 Apptainer: Incorrect path matching for 'limit container paths' directive

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

EUVD-2026-78889

Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths directive in apptainer.conf, so an allowed path such as /data/safe also authorizes a sibling path such as /data/safe-but-unsafe. A local...

CVE-2026-86258

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

CVE-2026-86258

nbviewer through version 1.0.1 is affected by a path traversal vulnerability in LocalFileHandler.can_show(). The root cause is the use of string-prefix comparison instead of proper path validation, allowing attackers to request paths that share the configured root as a textual prefix and thereby ...

CVE-2026-86258 nbviewer through 1.0.1 Path Traversal via LocalFileHandler

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

CVE-2026-86258 nbviewer through 1.0.1 Path Traversal via LocalFileHandler

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.canshow that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual prefi...

PT-2026-86528

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can show that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibling directories outside the configured root by requesting paths that share the root as a textual...

PYSEC-2026-3800

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...

CVE-2026-81716

opensslencrypt pip: openssl-encrypt versions before 1.4.9 contain a path traversal flaw in PluginSandbox.issafepath, which authorized file access using a bare string-prefix match. A sandboxed plugin without the READFILES permission could read or write another plugin's directory that merely shares...