SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via d...

CVE-2026-77086

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing aut

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's ob...

CVE-2026-77751

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-ST

历史摘要 · 未重新核验 · NVD

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic...

CVE-2026-69400

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

历史摘要 · 未重新核验 · GitHub Advisory

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security...

CVE-2026-17424

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to impro

历史摘要 · 未重新核验 · GitHub Advisory

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-69400

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

历史摘要 · 未重新核验 · NVD

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client...

CVE-2026-49244

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP

历史摘要 · 未重新核验 · NVD

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restricted directory.

CVE-2026-17424

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to impro

历史摘要 · 未重新核验 · NVD

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requires the name to match ^[a-z0-9_-]+$, is reached from sav...

CVE-2026-73040

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requ

历史摘要 · 未重新核验 · NVD

Dockge Path Traversal via Unvalidated Stack Name Allows Arbitrary Compose and .env Disclosure and Arbitrary Directory Deletion

CVE-2026-73040

Dockge validates a stack name only on the write path. In backend/stack.ts the allow-list check in validate(), which requ

历史摘要 · 未重新核验 · OSV.dev

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside...

CVE-2026-64777

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of wha

历史摘要 · 未重新核验 · NVD

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior ...

CVE-2026-53584

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

历史摘要 · 未重新核验 · NVD

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

### Impact Affected versions of Winter CMS allow authenticated backend users with the `cms.manage_assets` permission ("

历史摘要 · 未重新核验 · GitHub Advisory

Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets

CVE-2026-63179

### Impact Affected versions of Winter CMS allow authenticated backend users with the following permissions to disclose

历史摘要 · 未重新核验 · GitHub Advisory

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include fil...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file c

历史摘要 · 未重新核验 · NVD

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates ...

CVE-2026-71492

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry

历史摘要 · 未重新核验 · NVD

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path compo...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.

历史摘要 · 未重新核验 · NVD

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected ...

CVE-2026-18274

Heimdall Data Database Proxy uploadJar Directory Traversal Remote Code Execution Vulnerability. This vulnerability allow

历史摘要 · 未重新核验 · NVD

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-infl...

CVE-2026-63490

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handleb

历史摘要 · 未重新核验 · NVD

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information System Authority (RIA) DigiDoc4 client. This issue affects ...

CVE-2026-70383

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information Sys

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This...

CVE-2026-64967

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access

历史摘要 · 未重新核验 · NVD