MoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer
CVE-2026-108751
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows
#cwe-59
共收录 498 条相关情报。
← 返回所有主题answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding
CVE-2026-108723
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where
open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outsi...
CVE-2026-108600
open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path ch...
CVE-2026-108599
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and...
CVE-2026-108119
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsa
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved de...
CVE-2026-108119
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsa
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
CVE-2026-107810
### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the r
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and resto...
CVE-2026-107810
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
CVE-2026-107810
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection...
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive ext
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalis...
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive ext
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovere...
CVE-2026-107716
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry d
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
CVE-2026-107716
### Summary In `banks.registries.DirectoryPromptRegistry`, prompt file paths and the index file (`index.json`) do not re
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
CVE-2026-107716
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry d
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders ...
CVE-2026-107707
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that all
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local ...
CVE-2026-106508
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node pack
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdoc...
CVE-2026-106507
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node pack
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper t...
CVE-2026-106500
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/pl
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-sca...
CVE-2026-106486
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-m
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Run...
CVE-2026-76061
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malici