PT-2026-66517

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.7.0 through 1.11.1 Description Improper handling of REST batch multipart uploads allows a remote attacker to use path traversal sequences in the client-supplied filename. This can lead to the server writing controlled...

The vulnerability of the sqlite3ReleaseTempReg() function in the expr.c file of the SQLite database management system allows a attacker to cause a service failure, memory corruption, or execute arbitrary code.

The vulnerability of the sqlite3ReleaseTempReg function in the expr.c file of the SQLite database management system is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause service failures, memory leaks, or execute arbitrary code...

CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607

SiYuan before v3.7.2 has a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). The branch concatenates the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath check...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

EUVD-2026-48243

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

PT-2026-63973

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description An authenticated attacker can exploit a path traversal issue in the /export/temp/ endpoint within the serveExport handler located in kernel/server/serve.go. The vulnerability exists because the...

EUVD-2026-42893

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads...

CVE-2026-15791

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

CVE-2026-15791

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2752)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename wh...

CVE-2026-15791: Improper Limitation of a Pathname to a Restricted Directory

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the build container rootfs can escape into the real host temp directory...

EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

CVE-2026-15160

Summary of CVE-2026-15160 : The Ninja Forms - Excel Export plugin for WordPress is vulnerable to a directory traversal flaw in all versions up to and including 3.3.6, exploitable via the spreadsheet_export_tmp_name parameter. This vulnerability allows an authenticated user with subscriber-level a...

Directory Traversal

Overview whistle is a HTTP, HTTP2, HTTPS, Websocket debugging proxy Affected versions of this package are vulnerable to Directory Traversal in the GET /cgi-bin/temp/get handler in service.js. An attacker can read arbitrary files on the server by supplying a crafted filename parameter such as...

CVE-2026-55629

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...

CVE-2026-55629

CVE-2026-55629 affects Whistle (HTTP/HTTP2/HTTPS/WebSocket proxy). Before 2.10.3, the code path in lib/service/service.js for GET /cgi-bin/temp/get uses req.query.filename and joins it to TEMP_FILES_PATH only if it matches the temp-file pattern; otherwise it passes the user-supplied filename to g...