Linux Distros Unpatched Vulnerability : CVE-2026-61372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through...

PT-2026-67408

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Insufficient validation of the avID parameter in attribute-view read endpoints allows attackers to create traversal paths that escape the storage directory. This enables authenticated users with...

PT-2026-67452

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove package/plugins.install package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556...

PT-2026-67020

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

HashiCorp Consul Template 0.42.0 Path Redirection File Overwrite / Information Disclosure

This repository holds details relating to a HashiCorp Consul Template version 0.42.0 path redirection file overwrite vulnerability. HashiCorp Consul Template versions 0.42.0 and earlier contain a path resolution flaw in the writeToFile template helper where operator-supplied output paths are open...

EUVD-2026-52480

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...

CVE-2026-67973

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

ALSA-2026:49520 Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

GHSA-XRQW-3RRV-VX5W Transformers save_pretrained path traversal allows arbitrary file writes through chat template names

A vulnerability in huggingface/transformers versions 5.10.0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

EUVD-2026-52005

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856

The CVE-2026-9856 entry describes a path traversal flaw in huggingface/transformers

CVE-2026-9856

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

CVE-2026-9856 Path Traversal in huggingface/transformers

A vulnerability in huggingface/transformers versions =5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the savepretrained methods of PreTrainedTokenizerBase and ProcessorMixin, where keys from the chattemplate dictionary are used directly as...

Exploit for Path Traversal in Stitionai Devika

CVE-2024-40422 Python implementation...

CVE-2025-71399

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 which bundles the fixed rou3, this can allow...

CVE-2026-68582 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token

Vikunja versions = 0.24.0 and = 2.3.0 contain a broken object level authorization BOLA vulnerability in the task-collection endpoint GET /api/v1/projects/project/views/view/tasks. The endpoint loads the requested project view from the URL path without verifying the caller is authorized for it. Fo...