When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 332-339) reads response['value...

CVE-2026-41009

When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient

历史摘要 · 未重新核验 · NVD

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

CVE-2026-44705

### Summary The tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary dir

历史摘要 · 未重新核验 · GitHub Advisory

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

CVE-2026-44177

### TL;DR This vulnerability affects all Kirby sites on Kirby 5.3.0-5.4.0 and is independent from setup conditions and

历史摘要 · 未重新核验 · GitHub Advisory

SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory()...

CVE-2026-44788

SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a pa

历史摘要 · 未重新核验 · NVD

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specif...

CVE-2026-42448

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.2

历史摘要 · 未重新核验 · NVD

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flag...

CVE-2026-48126

Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --let

历史摘要 · 未重新核验 · NVD

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but ...

CVE-2026-43982

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go use

历史摘要 · 未重新核验 · NVD

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability.

CVE-2026-40384

An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerabili

历史摘要 · 未重新核验 · NVD

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

CVE-2026-40383

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

历史摘要 · 未重新核验 · NVD

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. Affected by this issue is some unknown functionality of ...

CVE-2026-9550

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0.

历史摘要 · 未重新核验 · NVD

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitr...

CVE-2026-41917

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scriptin

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file...

CVE-2026-9473

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileConten

历史摘要 · 未重新核验 · NVD

A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the function download_markdown/list_downloaded_files/create_subdir...

CVE-2026-9472

A flaw has been found in dazeb markdown-downloader up to 3d4394b34b6c99d81af817623af55e3384df5a6a. Affected is the funct

历史摘要 · 未重新核验 · NVD

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

## Summary `publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields w

历史摘要 · 未重新核验 · GitHub Advisory

A malicious actor with access to the network and low privileges could exploit a Path Traversal...

CVE-2026-34911

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in Un

历史摘要 · 未重新核验 · GitHub Advisory

A malicious actor with access to the network could exploit a Path Traversal vulnerability found...

CVE-2026-34909

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a

历史摘要 · 未重新核验 · GitHub Advisory

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system t...

CVE-2026-34911

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in Un

历史摘要 · 未重新核验 · NVD

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipu...

CVE-2026-34909

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to a

历史摘要 · 未重新核验 · NVD

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

CVE-2026-46703

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI

历史摘要 · 未重新核验 · GitHub Advisory

Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

CVE-2026-46671

### Impact A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary

历史摘要 · 未重新核验 · GitHub Advisory