SUSE-SU-2026:4610-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. - CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc128251...

CVE-2026-104081

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

Security Bulletin: IBM® Db2® could allow a DBADM authenticated user to send a specially crafted request to write arbitrary files on the system (CVE-2026-86087)

Summary IBM® Db2® could allow a database administration authority DBADM authenticated user to send a specially crafted request to write arbitrary files on the system CVE-2026-86087 Vulnerability Details CVEID:CVE-2026-86087 DESCRIPTION: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou...

EUVD-2026-95797

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-104081

KodExplorer versions prior to 4.55 are vulnerable to a path traversal vulnerability located in the unzip_pre_name() function within app/function/helper.function.php. The root cause is a non-recursive str_replace() sanitization pass that can be bypassed using crafted filenames like ....//, combine...

CVE-2026-104081 KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-104081 KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction

KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...

CVE-2026-103663

A flaw was found in Ollama. This vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution by exploiting a path traversal flaw in the model pull application programming interface API endpoint. By supplying a crafted layer identifier, an attacker can write malicio...

Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak

Summary A security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak. Python is used by IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak as part of its deployment. This bulletin identifies the fixes...

CVE-2026-103412

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

CVE-2026-103412 Apache Camel Karavan: project file name path traversal when committing a project to Git

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

CVE-2026-103412 Apache Camel Karavan: project file name path traversal when committing a project to Git

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

EUVD-2026-95756

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

CVE-2026-103412

Apache Camel Karavan versions from 3.18.0 before 4.22.1 are vulnerable to a path traversal vulnerability. The application's project file API uses project file names verbatim as path segments when writing to a working copy for a Git commit. By providing a name containing ../ sequences, an authenti...

SUSE-SU-2026:4606-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: - Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infini...

Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: golang-github-prometheus-prometheus was updated to version 3.13.2: Security issues: CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling bsc1266608 CVE-2026-56852: Fixed infinite...

BIT-GHOST-2026-104417 Ghost 1.20.0 before 6.64.0 Path Traversal via Locale Setting

Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposin...

BIT-GHOST-2026-103290 Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-30892 DESCRIPTION: crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u --user is incorrectly...

CVE-2026-94664

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...