Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:15:56 +0000 EUVD-2026-240953 https://cve.radiocsirt.org/vuln/euvd-2026-240953 EUVD-2026-240953 https://cve.radiocsirt.org/vuln/euvd-2026-240953 fkie_cve-2023-6569 https://cve.radiocsirt.org/vuln/fkie_cve-2023-6569 <p>External Control of File Name or Path in h2oai/h2o-3</p> <p>External Control of File Name or Path in h2oai/h2o-3</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-6569 GHSA-gqrq-j6pm-98c2 — External Control of File Name or Path in h2oai/h2o-3 https://cve.radiocsirt.org/vuln/ghsa-gqrq-j6pm-98c2 <p><strong>Affected:</strong> PyPI: h2o</p> <p>Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with &#34;C1&#34;, if they&#39;re exporting as CSV.</p> <p><strong>Affected:</strong> PyPI: h2o</p> <p>Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with &#34;C1&#34;, if they&#39;re exporting as CSV.</p> https://cve.radiocsirt.org/vuln/ghsa-gqrq-j6pm-98c2 gsd-2023-6569 https://cve.radiocsirt.org/vuln/gsd-2023-6569 gsd-2023-6569 https://cve.radiocsirt.org/vuln/gsd-2023-6569 PYSEC-2026-350 — External Control of File Name or Path in h2oai/h2o-3 https://cve.radiocsirt.org/vuln/pysec-2026-350 <p><strong>Affected:</strong> PyPI: h2o</p> <p>Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with &#34;C1&#34;, if they&#39;re exporting as CSV.</p> <p><strong>Affected:</strong> PyPI: h2o</p> <p>Remote unauthenticated attackers can overwrite arbitrary server files with attacker-controllable data. The data that the attacker can control is not entirely arbitrary. h2o writes a CSV/XLS/etc file to disk, so the attacker data is wrapped in quotations and starts with &#34;C1&#34;, if they&#39;re exporting as CSV.</p> https://cve.radiocsirt.org/vuln/pysec-2026-350