proma-ai Proma File Preview Service file-preview-service.ts resolveTargetPath path traversal
CVE-2026-88790
A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath o
#advisory
共收录 23661 条相关情报。
← 返回所有主题ION-DTN < 4.2.1-a.1 Denial of Service via canonicalizePayloadBlock() Assertion
CVE-2026-75584
ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to cras
ICEcoder through 8.1 Path Traversal via oldFileName Parameter
CVE-2026-64838
ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, al
ICEcoder through 8.1 OS Command Injection via lib/properties.php
CVE-2026-64837
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authentica
ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement
CVE-2026-64836
ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error i
MISP: Unescaped HTML Injection in PDF Report Element Rendering
CVE-2026-88921
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for re
Suricata lua: sandbox allocation limit not enforced for new allocations
CVE-2026-45763
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. St
EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
CVE-2026-88896
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates
Snipe-IT before 8.7.2 Authorization Bypass via Predefined Kit Checkout
CVE-2026-88894
Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the ch
Renovate before 44.14.7 Command Injection via distributionType
CVE-2026-88889
Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to
Renovate before 44.14.7 Command Injection via Mix organization
CVE-2026-88888
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependenci
Renovate before 44.11.2 Credential Exfiltration via Link Header
CVE-2026-88887
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagin
Renovate before 44.14.7 Command Injection via gradle-wrapper
CVE-2026-88886
Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions be
Renovate before 44.14.7 Command Injection via depName
CVE-2026-88885
Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depNam
Renovate before 44.3.1 Authentication Bypass via Digest Updates
CVE-2026-88884
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0
Renovate before 44.14.4 TLS Private Key Log Sanitisation
CVE-2026-88883
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.
Renovate before 44.11.2 Credential Exfiltration via Link Header
CVE-2026-88882
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts b
Renovate before 44.11.3 Credential Exfiltration via Link Header
CVE-2026-88881
Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header whe
Renovate before 44.11.3 Credential Exfiltration via Link Header
CVE-2026-88880
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing mal
Traefik before v2.11.56 Identity Spoofing via Header Alias
CVE-2026-88011 · CVE-2026-88879
Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11,