Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 05:29:00 +0000 CVE-2026-52832 — Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container https://cve.radiocsirt.org/vuln/cve-2026-52832 <p><strong>Affected:</strong> nuclio</p> <p>Nuclio is a &#34;Serverless&#34; framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.</p> <p><strong>Affected:</strong> nuclio</p> <p>Nuclio is a &#34;Serverless&#34; framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed by functionconfig.ParseHandler() which splits on : only — no path validation is applied to the module portion. This issue has been patched in version 1.16.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-52832