A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.a...

CVE-2026-84431

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.c

历史摘要 · 未重新核验 · NVD

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directory. Attackers can supply traversal se...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs

历史摘要 · 未重新核验 · NVD

facefusion before 3.7.0 Path Traversal via Job Identifier

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outs

历史摘要 · 未重新核验 · OSV.dev

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy() method resolves...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php

历史摘要 · 未重新核验 · NVD

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/no...

CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

历史摘要 · 未重新核验 · NVD

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache ...

CVE-2026-75604

Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js app

历史摘要 · 未重新核验 · NVD

Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock

CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

历史摘要 · 未重新核验 · OSV.dev

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every travers...

CVE-2026-84365

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix

历史摘要 · 未重新核验 · NVD

Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerabilities allows an attacker to write arbitrary files to th...

CVE-2026-73765

Authenticated path traversal vulnerabilities exist in API endpoints of AOS-CX. Successful exploitation of these vulnerab

历史摘要 · 未重新核验 · NVD

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based manag...

CVE-2026-73760

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an

历史摘要 · 未重新核验 · NVD

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary fi...

CVE-2026-73752

An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of th

历史摘要 · 未重新核验 · NVD

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversa...

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauth

历史摘要 · 未重新核验 · NVD

An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent att...

CVE-2026-73737

An unauthenticated path traversal vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful

历史摘要 · 未重新核验 · NVD

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a fro

历史摘要 · 未重新核验 · GitHub Advisory

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers to write files outside the intended ...

CVE-2026-84201

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools

历史摘要 · 未重新核验 · NVD

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code ...

CVE-2026-61753

NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A suc

历史摘要 · 未重新核验 · NVD

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versi...

CVE-2026-19952

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality...

CVE-2026-67395

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati

历史摘要 · 未重新核验 · GitHub Advisory

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory trave...

CVE-2026-67395

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validati

历史摘要 · 未重新核验 · NVD

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function...

CVE-2026-82954

A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the fi

历史摘要 · 未重新核验 · GitHub Advisory