Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.24.0 until 1.1.0, McpContext.validatePath() enforces wo...

CVE-2026-53766

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From

历史摘要 · 未重新核验 · NVD

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From 0.20.0 until 1.1.0, The chrome-devtools-mcp daemon writes...

CVE-2026-53765

Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live Chrome browser. From

历史摘要 · 未重新核验 · NVD

Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPat...

CVE-2026-52811

Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only

历史摘要 · 未重新核验 · NVD

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file ...

CVE-2026-23879

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryptio

历史摘要 · 未重新核验 · NVD

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing pa...

CVE-2026-35025

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users

历史摘要 · 未重新核验 · NVD

Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload

CVE-2026-54352

## Summary `POST /api/pwa/process-zip` at `packages/server/src/api/routes/static.ts:24` accepts a builder-uploaded `.zi

历史摘要 · 未重新核验 · GitHub Advisory

skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery

## Impact Following the path-safety patches in [GHSA-wx3m-whqv-xv47](https://github.com/umanio-agency/skillctl/security

历史摘要 · 未重新核验 · GitHub Advisory

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution...

CVE-2026-44274

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vul

历史摘要 · 未重新核验 · GitHub Advisory

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access c...

CVE-2026-44274

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vul

历史摘要 · 未重新核验 · NVD

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns d...

CVE-2026-55443

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components

历史摘要 · 未重新核验 · NVD

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build...

CVE-2026-56236

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations th

历史摘要 · 未重新核验 · GitHub Advisory

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can crea...

CVE-2026-56236

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations th

历史摘要 · 未重新核验 · NVD

pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

### Summary `NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_n

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups

### Summary `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles

历史摘要 · 未重新核验 · GitHub Advisory

go.qbee.io/transport: Symlink-chain path traversal in tar extraction (one level outside destination)

CVE-2026-55828

### Impact The go.qbee.io/transport library is affected by a symlink-chain path traversal vulnerability in its extractT

历史摘要 · 未重新核验 · GitHub Advisory

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation...

CVE-2026-47833

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A comp

历史摘要 · 未重新核验 · GitHub Advisory

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A compromised process inside a bpm container can cause root to ...

CVE-2026-47833

setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via /etc/shadow. A comp

历史摘要 · 未重新核验 · NVD

Crawl4AI: Arbitrary file write (path traversal) in crawler downloads can lead to RCE

### Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input

历史摘要 · 未重新核验 · GitHub Advisory

The github_workflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory c...

CVE-2026-12567

The github_workflows module constructs local directory paths from user-controlled repository names without validating fo

历史摘要 · 未重新核验 · NVD

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in...

CVE-2026-50656

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicl

历史摘要 · 未重新核验 · GitHub Advisory