#cwe-73

共收录 423 条相关情报。

← 返回所有主题
漏洞预警2026-07-21 发布INFO

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `EntryPoint::FromStr` in `rattler_conda_types` performs only `....

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, `Entry

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-21 发布INFO

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitr...

CVE-2026-15724

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-20 发布INFO

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files o...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and ser

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-20 发布INFO

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()` reads each backup's `_manifest.json` and trusts the mani...

CVE-2026-58484

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()`

历史摘要 · 未重新核验 · NVD

安全公告2026-07-20 发布INFO

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

CVE-2026-58484

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()`

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-20 发布INFO

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','j...

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enfo

历史摘要 · 未重新核验 · NVD

安全公告2026-07-20 发布INFO

CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations

CVE-2026-45139

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enfo

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-17 发布INFO

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not acco...

CVE-2026-50162

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a le

历史摘要 · 未重新核验 · NVD

安全公告2026-07-17 发布INFO

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

CVE-2026-9587

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-17 发布INFO

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the s...

CVE-2026-9587

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-16 发布INFO

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow ...

CVE-2026-44019

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.

历史摘要 · 未重新核验 · NVD

安全公告2026-07-16 发布INFO

Docling Core has insufficient validation of image reference URIs

CVE-2026-44019

Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-16 发布INFO

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated use...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

历史摘要 · 未重新核验 · NVD

安全公告2026-07-16 发布INFO

Manyfold: Authenticated Path Traversal via File Rename

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-16 发布INFO

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrat...

CVE-2026-12979

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a t

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.1 through 0.40.5, `nvm ls-remote` (and other commands tha...

CVE-2026-15921

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

历史摘要 · 未重新核验 · NVD

安全公告2026-07-15 发布INFO

nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory

CVE-2026-15921

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.32.

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-15 发布INFO

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user...

CVE-2026-50148

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.2

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-15 发布INFO

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig proc...

CVE-2026-61873

Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, w

历史摘要 · 未重新核验 · NVD

安全公告2026-07-15 发布INFO

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wa

历史摘要 · 未重新核验 · GitHub Advisory