99804 matches found
openSUSE 16: helm / helm-bash-completion / helm-fish-completion / etc (openSUSE-SU-2026:21983-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21983-1 advisory. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204:...
Important: Red Hat Security Advisory: libpcap security update
An update for libpcap is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access
A flaw was found in libpcap. The Berkeley Packet Filter BPF interpreter in libpcap does not properly validate register indexes in BPF instructions. A local attacker could craft a malicious filter program to trigger an out-of-bounds read and write vulnerability. This could allow the attacker to re...
CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...
CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...
CVE-2026-103764 Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport
Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated attackers to read and write arbitrary process memory via the TCP transport data port. Attackers can send a crafted SessionHeader with arbitrary addr and size...
CVE-2025-71427
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...
CVE-2025-71427
The Office-PowerPoint-MCP-Server (versions prior to 2.0.8 ) is vulnerable to a path traversal flaw. This vulnerability allows MCP callers to read and write files outside the intended working directory by providing absolute paths or ../ sequences. An attacker can leverage prompt injection to manip...
CVE-2025-71427 Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...
Exploit for Argument Injection in Thecodingmachine Gotenberg
CVE-2026-40281 Gotenberg --- 📖 Table of...
CVE-2026-51888
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...
CVE-2026-51880
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...
CVE-2026-51873
Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...
Exploit for CVE-2026-104286
FortiMail CVE-2026-104286 Path Traversal Exploit Overview...
CVE-2026-102514
Out-of-bounds Write CWE-787 in the PEA archive extraction routine pea.pas, unpeaprocedure of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While...
GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go
Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...
GO-2026-6563 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...
CVE-2026-82358
RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO Service Data Object server implementation 'src/cosdoserver.c' that fails to properly validate write permissions when processing download-segment frames. An unauthenticated attacker on the CAN bus can initiate an SDO upload fo...
CVE-2026-104286
An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on th...