Tencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal
CVE-2026-101080
A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. This affects the function startsWith of the
#advisory
共收录 23312 条相关情报。
← 返回所有主题Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
CVE-2026-88804
An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripti
Session Not Revoked Server-Side on Logout in Rancher
CVE-2026-88805
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the acco
Langflow Code Execution via eval() in Component Input Schema
CVE-2026-101861
Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows a
agentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision
CVE-2026-101079
A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function i
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
CVE-2026-88808
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters
Fleet applies namespace labels and annotations without the bundle's service account privileges
CVE-2026-93540
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLa
Unauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver
CVE-2026-93539
A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is no
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
CVE-2026-93538
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cl
scim-patch: Mutation of Inherited Built-in Method Objects
CVE-2026-61834
## Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects `scim-patch` blocks
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
## `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78) ### Summary The `grep_search` tool
Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
CVE-2026-93537
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push acce
LXD client recursive file pull allows directory escape via malicious VM agent
CVE-2026-87798
Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to
Arbitrary file write on LXD host via symlink in migration stream
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,
Incorrect authorization in LXD storage volume API allows reading volumes from other projects
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed
Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
CVE-2026-85185
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 an
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
CVE-2026-85526
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with in
LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
CVE-2026-86335
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restri
CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10,
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)