#cwe-22

共收录 2809 条相关情报。

← 返回所有主题
漏洞预警2026-07-08 发布INFO

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contain...

CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Appium: Unauthenticated arbitrary file/directory deletion in @appium/storage-plugin

CVE-2026-58192

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

AsyncSSH: SCP Path Traversal to Arbitrary File Write

CVE-2026-54591

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

DSpace: Path Traversal is possible through LDN message generation

CVE-2026-49833

## Overview A path traversal vulnerability is possible via the [COAR Notify / LDN](https://wiki.lyrasis.org/spaces/DSDO

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-08 发布INFO

DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

CVE-2026-49831

## Overview The [Curation Task](https://wiki.lyrasis.org/spaces/DSDOC9x/pages/379126845/Curation+Tasks) feature allows

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-08 发布INFO

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private...

CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package insta...

CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containi

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate fil...

CVE-2026-59820

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Sk

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass user-controlled input to Handlebars.compile() using FileTem...

CVE-2026-55760

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass us

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Composer: Arbitrary file write outside vendor via malicious transitive package name

CVE-2026-59948

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

CVE-2026-59946

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containi

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2026-59820

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.7-stable, LiteLLM Sk

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-08 发布INFO

handlebars.java FileTemplateLoader Path Traversal

CVE-2026-55760

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, applications that pass us

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the resul...

CVE-2026-59924

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes use

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Mistune: Arbitrary File Read via Include directive path traversal

CVE-2026-59924

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes use

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the templa...

CVE-2026-53951

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a c...

CVE-2026-14967

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory

历史摘要 · 未重新核验 · NVD

安全公告2026-07-08 发布INFO

Copier: trust-prefix bypass via path traversal runs tasks unprompted

CVE-2026-53951

Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-08 发布INFO

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadP...

CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in th

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-08 发布INFO

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the sy...

CVE-2026-55668

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor

历史摘要 · 未重新核验 · NVD