共收录 2701 条相关情报。
← 返回所有主题CVE-2026-54650
openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in internal/server/publ
CVE-2026-66064
## Summary `sendFile` derives the served filename from the raw request path while opening the file from the cleaned pat
CVE-2026-54659
### Summary `Pagy::I18n.locale=` did not validate its argument before using it as a path component to load the matching
CVE-2026-54650
## Summary openhole-server forwarded the URL-decoded request path (`r.URL.Path`) to tunnel clients instead of the origi
CVE-2026-55390
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema pars
CVE-2026-55389
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Sch
CVE-2026-66063
## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write o
CVE-2026-55389
### Summary `datamodel-code-generator` resolves JSON-Schema `$ref` targets that point at the local filesystem without r
CVE-2026-14973
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's s
CVE-2026-15280
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segm
CVE-2026-5114
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and
CVE-2026-48374
Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability th
CVE-2026-55390
### Summary When generating models from an XML Schema (`--input-file-type xmlschema`), `datamodel-code-generator` resol
CVE-2026-15280
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segm
CVE-2026-14973
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's s
CVE-2026-50567
`Unarchive` in `pkg/utils/zip.go` joined each archive entry name with the destination directory via `filepath.Join` and
CVE-2026-5114
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and
CVE-2026-48374
Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability th
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary fi
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary fi