CVE-2026-6636

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affected is the function Bun.serve of the file buildCache.js of the component API. Performing a manipulation of the argument pathname results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-663607.5The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check inCVE-2026-663628.1Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configCVE-2026-663646.5The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on theCVE-2026-663696.5The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame onCVE-2026-66378.8Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system uCVE-2026-663706.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticatedCVE-2026-663726.8The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seeCVE-2026-663737.5Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE paylCVE-2026-663748.1Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.CVE-2026-663758.1A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.CVE-2026-663765.4Credentials for a deleted user may remain valid for a short period under specific conditions.CVE-2026-663775.3An unauthenticated user may access restricted repository information under specific conditions.