uniget: Path Traversal in Hook Files - Directory Escape Vulnerability
CVE-2026-55062
uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget
#cwe-73
共收录 423 条相关情报。
← 返回所有主题mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing...
CVE-2026-54583
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-d
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affec...
CVE-2026-54582
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the ...
CVE-2026-92595
Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAcc
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from un...
CVE-2026-63225
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the spl
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path ...
CVE-2026-76796
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parame
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader throug...
CVE-2026-54629
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtu
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without rest...
CVE-2026-50006
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL fro
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService (e.g. BackupServic...
CVE-2026-90932
LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. C
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim ...
CVE-2026-49836
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()`
mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url
### Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary l
n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read
CVE-2026-86995
## Impact The Git node validated the repository that a fetch or pull targeted, but `setUpstream` wrote a `branch..remot
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary direct...
CVE-2026-88899
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode pro
knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header
CVE-2026-88899
knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode pro
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vul...
CVE-2026-53956
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to versio
Rattler vulnerable to package cache path traversal via conda package build string
CVE-2026-53956
Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to versio
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
### Summary The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into t
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature
### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an applicati
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-69383
External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally.
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-69355
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a