Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatechec...

CVE-2026-119336

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From

来源摘录 · NVD

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

CVE-2026-115908

### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The

来源摘录 · GitHub Advisory

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths, causing renameat on macOS and FreeBS...

CVE-2026-118688

wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to

来源摘录 · NVD / GitHub Advisory

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image...

CVE-2026-115424

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the applicati

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency...

CVE-2026-115392

Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandb

来源摘录 · NVD

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations...

CVE-2026-108981

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served

历史摘要 · 未重新核验 · GitHub Advisory

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user ac...

CVE-2026-108981

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served

历史摘要 · 未重新核验 · NVD

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

CVE-2026-107810

### Summary An authenticated user who can create and restore a backup can craft a valid backup archive that causes the r

历史摘要 · 未重新核验 · GitHub Advisory

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and resto...

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i

历史摘要 · 未重新核验 · NVD

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i

历史摘要 · 未重新核验 · OSV.dev

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdoc...

CVE-2026-106507

Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node pack

历史摘要 · 未重新核验 · NVD

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory ...

CVE-2026-105712

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted arch

历史摘要 · 未重新核验 · NVD

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

## Summary Dulwich's `porcelain.checkout(paths=[...])` code path writes files using raw `os.open(file_path, O_WRONLY|O_

历史摘要 · 未重新核验 · GitHub Advisory

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as ...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files ...

CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a maliciou

历史摘要 · 未重新核验 · NVD

Language Servers for AWS vulnerable to arbitrary file write

CVE-2026-12958

## Summary Language Servers for AWS (the aws/language-servers project) provides the Language Server Protocol implementat

历史摘要 · 未重新核验 · GitHub Advisory

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal ...

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivi

历史摘要 · 未重新核验 · NVD

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The...

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regener

历史摘要 · 未重新核验 · NVD

CVE-2026-96808

CVE-2026-96808

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivi

历史摘要 · 未重新核验 · OSV.dev

CVE-2026-96807

CVE-2026-96807

In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regener

历史摘要 · 未重新核验 · OSV.dev