CVE-2026-17459Medium· 4.3▾ SunlitA vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.5%
A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115908High· 7.4zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
CVE-2025-67487High· 8.6Static Web Server (SWS) is a production-ready web server suitable for static web files or assets
CVE-2026-107810High· 8.1Nginx UI is a web user interface for the Nginx web server
CVE-2025-11489Medium· 4.5A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13
CVE-2025-14693Medium· 6.2A vulnerability has been found in Ugreen DH2100+ up to 5.3.0
CVE-2026-106507Medium· 5.3Backstage is an open framework for building developer portals