CVE-2026-18582

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

CVE-2026-59641

CVE-2026-59641 affects Bouncy Castle for Java: before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation; also affects Java LTS before 2.73.12 and Java FIPS (BC-FJA) before bcmail-fips and bcjmail-fips 1.0.7 (1.0.x), 2.0.7 (2.0.x), and 2.1.7 (2.1.x). CVSS v4.0 base scor...

CVE-2026-59641 S/MIME validator trusts signer-asserted signingTime for path validation

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

CVE-2026-59641

In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bcmail-fips and bcjmail-fips 1.0.7 1.0.X series, 2.0.7 2.0.X series and...

CVE-2026-67970

Incorrect access control in the DSSetDestPathCmd component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal...

VulnCheck KEV: CVE-2026-54066

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...

Linux Distros Unpatched Vulnerability : CVE-2026-61372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through...

Important: mingw-glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: GLib: Buffer underflow...

CVE-2026-67970

The connected documents confirm a vulnerability in NASA cFS v7.0.1 involving the DS_SetDestPathCmd() component, where incorrect access control enables path traversal to access sensitive components. The issue is described consistently across NVD, CVE records, EUVD ENISA, and CVE listings. The CVSS...

RHEL 8 : ldns (RHSA-2026:49520)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49520 advisory. The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define...

PT-2026-67020

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

PT-2026-67452

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.remove package/plugins.install package of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

PT-2026-67408

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Insufficient validation of the avID parameter in attribute-view read endpoints allows attackers to create traversal paths that escape the storage directory. This enables authenticated users with...

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556...

CVE-2026-67973

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via replaying final CFDP PDUs...

EUVD-2026-52480

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component...

ALSA-2026:49520 Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...

HashiCorp Consul Template 0.42.0 Path Redirection File Overwrite / Information Disclosure

This repository holds details relating to a HashiCorp Consul Template version 0.42.0 path redirection file overwrite vulnerability. HashiCorp Consul Template versions 0.42.0 and earlier contain a path resolution flaw in the writeToFile template helper where operator-supplied output paths are open...

Important: ldns security update

The ldns packages contain a library with the aim to simplify DNS programming in C. All low-level DNS/DNSSEC operations are supported. We also define a higher level API which allows a programmer to for instance create or sign packets. Security Fixes: ldns: ldns: Off-path poisoning attacks due to...