Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files
CVE-2026-92164
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSes
#cwe-73
共收录 423 条相关情报。
← 返回所有主题Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories o...
CVE-2026-91797
Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malici
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlle...
CVE-2026-77247
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji
MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters
CVE-2026-77247
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a cal...
CVE-2026-83603
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta
Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
CVE-2026-83603
Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confi...
CVE-2026-77621
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated
Vector: Arbitrary file write in the file sink via templated path (path traversal).
CVE-2026-77621
Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerabi...
CVE-2026-65125
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 ...
CVE-2026-61647
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough...
CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially ...
CVE-2026-90817
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proce
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve...
CVE-2026-93987
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin.
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a vol...
CVE-2026-93987
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin.
rclone serve docker Path Traversal via Volume Name
CVE-2026-93987
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin.
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not...
CVE-2026-19860
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PH
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation call...
CVE-2026-19860
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PH
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allo...
CVE-2026-6205
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager (DSM) before 7.2.1-
yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/ca...
CVE-2026-50158
yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with ...
CVE-2026-55062
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget