#cwe-22

共收录 2809 条相关情报。

漏洞预警2026-07-09 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decod...

CVE-2026-59832

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-07-09 发布INFO

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and th...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-09 发布INFO

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and...

CVE-2026-13492

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:high

漏洞预警2026-07-09 发布INFO

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/sr...

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-23

漏洞预警2026-07-09 发布INFO

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values i...

CVE-2026-13492

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-09 发布INFO

UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field

CVE-2026-13492

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-09 发布INFO

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

CVE-2026-59149

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-23

漏洞预警2026-07-09 发布INFO

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py d...

CVE-2026-59221

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitiz

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-918

漏洞预警2026-07-09 发布INFO

A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin...

CVE-2026-15204

A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415_B20250515/9.1.0cu.2350_B20230313. Affected by this vulnerab

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-09 发布INFO

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal

CVE-2026-59221

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitiz

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22 #cwe-918

漏洞预警2026-07-09 发布INFO

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient ...

CVE-2026-14372

The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is v

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-09 发布INFO

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue...

CVE-2026-15138

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:low

漏洞预警2026-07-09 发布INFO

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor/text_editor.py. S...

CVE-2026-15138

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validat

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-09 发布INFO

tumf mcp-text-editor text_editor.py _validate_file_path path traversal

CVE-2026-15138

A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-07-08 发布INFO

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copyi...

CVE-2026-55878

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-07-08 发布INFO

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing ...

CVE-2026-44024

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-07-08 发布INFO

Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest

CVE-2026-55878

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

安全公告2026-07-08 发布INFO

Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

CVE-2026-44024

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on.

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-22

漏洞预警2026-07-08 发布INFO

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storag...

CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-73

漏洞预警2026-07-08 发布INFO

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a mal...

CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22