#cwe-22

共收录 2738 条相关情报。

漏洞预警2026-07-21 发布INFO

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. `...

CVE-2026-47397

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents t

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-21 发布INFO

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The action that can normally be used to delete files inside the b...

CVE-2026-15791

A crafted message in the BuildKit low-level build API can be used to remove the contents of the /tmp directory. The acti

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-21 发布INFO

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid perm...

CVE-2026-15789

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-contro

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-21 发布INFO

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitr...

CVE-2026-15724

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22 #cwe-73

漏洞预警2026-07-21 发布INFO

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesyste...

CVE-2026-64825

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to wri

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-21 发布INFO

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem ...

CVE-2026-64824

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-21 发布INFO

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vu...

CVE-2026-47394

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is in

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200 #cwe-862

漏洞预警2026-07-21 发布INFO

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejec...

CVE-2026-47121

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `re

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-59

漏洞预警2026-07-21 发布INFO

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing u...

CVE-2026-13693

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-20 发布INFO

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to ...

CVE-2026-47144

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-20 发布INFO

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

CVE-2026-62843

## Summary The fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameIn