A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue...
CVE-2026-116602
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink o
#cwe-22
共收录 2611 条相关情报。
← 返回所有主题A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of...
CVE-2026-116602
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink o
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to ...
CVE-2026-115924
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
CVE-2026-107092
NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows...
CVE-2026-116191
Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to wr
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink...
CVE-2026-116195
Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath...
CVE-2026-116171
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows ex
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because...
CVE-2026-116168
SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths relie
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix (\\?\) survives filepath.Clean and m...
CVE-2026-116171
SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows ex
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read file...
CVE-2026-116067
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBacku
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.m...
CVE-2026-116045
A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file
When a post is published, Postiz treats a media path that is not a web address as a file on the...
CVE-2026-115932
When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it do
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the...
CVE-2026-116009
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to wr
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to write arbitrary files by supplying ../ sequences in the nam...
CVE-2026-116009
Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to wr
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL...
CVE-2026-113491
The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local
virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113719
## Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulti
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
### Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as `.*`, `.?`
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
CVE-2026-115569
### Impact Fallow reads the Jest and Vitest configs of the repository that it analyzes. A Jest `projects` entry or a Vi
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
### Summary On Windows, attacker-controlled content in a wheel's `.dist-info/namespace_packages.txt` can cause setuptoo
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is...
CVE-2026-115800
A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model o