https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 02:05:55 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110935 <p>The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as &#39;..&#39; are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user&#39;s permissions which could result in full system compromise.</p> <p>The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as &#39;..&#39; are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user&#39;s permissions which could result in full system compromise.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110935 https://db.gcve.eu/vuln/ghsa-gwv8-5mm7-6vg5 <p>The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as &#39;..&#39; are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user&#39;s permissions which could result in full system compromise.</p> <p>The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as &#39;..&#39; are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user&#39;s permissions which could result in full system compromise.</p> https://db.gcve.eu/vuln/ghsa-gwv8-5mm7-6vg5 https://db.gcve.eu/vuln/vde-2026-121 <p>GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.</p> <p>GSDX SignatureValue verification, signed plug-in validation bypass and path traversal vulnerabilities have been identified in PLCnext Engineer prior to version 2026.6. The effects of these vulnerabilities may result in a complete loss of confidentiality, integrity and availability.</p> https://db.gcve.eu/vuln/vde-2026-121