#cwe-22

共收录 2819 条相关情报。

漏洞预警2026-05-28 发布MEDIUM

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which c...

CVE-2026-9789

CVE-2026-9789 是一个影响 Acer NitroSense 软件（版本低于 3.01.3052）的本地权限提升（LPE）漏洞。漏洞源于 PSAdminAgent 服务，该服务创建了一个具有弱访问控制列表（ACL）的命名管道。任何

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-269 #cwe-284 #cwe-732

漏洞预警2026-05-27 发布INFO

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directl...

CVE-2026-46402

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Micro

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

安全公告2026-05-27 发布INFO

Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs

CVE-2026-47243

### Summary In the runtime-rs standalone virtio-fs path, verified here with QEMU (and verified with Cloud Hypervisor to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-22 #cwe-36 #severity:high

安全公告2026-05-27 发布INFO

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

CVE-2026-45309

## Summary AsyncSSH 2.22.0 expands the OpenSSH-compatible `AuthorizedKeysFile` `%u` token with the raw SSH username duri

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #severity:medium

漏洞预警2026-05-27 发布INFO

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (., [, ], *, **, ?). W...

CVE-2026-44635

Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does n

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-89 #cwe-915 #cwe-1284

漏洞预警2026-05-27 发布INFO

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme...

CVE-2026-44353

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streaml

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-05-27 发布INFO

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers...

CVE-2026-6957

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to constr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

安全公告2026-05-27 发布INFO

Agent Zero before version 1.15 contains a path traversal vulnerability that allows...

CVE-2026-47118

Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arb

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

安全公告2026-05-27 发布INFO

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the...

CVE-2026-48544

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() metho

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-05-27 发布INFO

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to construct export destination paths, which allows an administrat...

CVE-2026-6957

Mattermost Plugins versions <=1.1.5 fail to sanitize filenames received from federated peers before using them to constr

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() method in taipy/gui/extension/library.py that allows unauthent...

CVE-2026-48544

Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary.get_resource() metho

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying crafted paths to the image file...

CVE-2026-47118

Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated attackers to read arb

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data t...

CVE-2026-45571

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfe...

CVE-2026-9035

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links during archive extraction.

CVE-2026-7524

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links duri

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6, 1.0.2.7 could allow a remote attacker to traverse directo...

CVE-2026-3366

IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1.0.0.2, 1.0.2, 1.0.2.2, 1.0.2.3, 1.0.2.4, 1.0.2.5, 1.0.2.6,

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Path Traversal.T...

CVE-2026-42757

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saleswonder Team: Tobias

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP – Compress / Optimize Images & Convert WebP | SEO ...

CVE-2026-42756

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludwig You QuickWebP &#8

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Path Traversal.T...

CVE-2026-42737

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jvikwp VikBooking Hote

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-05-27 发布INFO

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functionality in Synology Surveillance Station before 9.2.2-11575 ...

CVE-2024-47267

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Archiving Pull functiona

历史摘要 · 未重新核验 · NVD

#cve #cwe-22