CVE-2026-51873: Improper Limitation of a Pathname to a Restricted Directory

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-64950: Improper Neutralization of Input During Web Page Generation

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-15983: External Control of File Name or Path

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316. This is due to the supersaveform AJAX handler performing no capability check — allowing Subscriber-level authenticated users to create ...

CVE-2026-51873

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

PT-2026-103737

Name of the Vulnerable Software and Affected Versions Super Forms – Drag & Drop Form Builder versions prior to 6.3.317 Description Authenticated users with Subscriber-level access and above can recursively delete arbitrary files and directories on the server, potentially leading to a full site...

AlmaLinux 9.2 [TuxCare] Security Update: tar (ALMALINUX9.2:CLSA-2026:1789128477)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789128477 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designate...

Rocky Linux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789580964)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789580964 advisory. - A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, the...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.2:CLSA-2025:1745426658)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745426658 advisory. - A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache...

AlmaLinux 9.2 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.2:CLSA-2026:1787755227)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787755227 advisory. - A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit...

Rocky Linux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787306784)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787306784 advisory. - A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV...

Rocky Linux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787315165)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787315165 advisory. - Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, becau...

Rocky Linux 9.6 [TuxCare] Security Update: podman / podman-docker / podman-plugins / podman-remote / etc (ALMALINUX9.6:CLSA-2026:1782987821)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782987821 advisory. - Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious container image where the WORKDIR path...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11-pip / python3.11-pip-wheel (ALMALINUX9.2:CLSA-2025:1765376235)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1765376235 advisory. - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote...

AlmaLinux 9.6 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1787315165)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787315165 advisory. - Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because...

AlmaLinux 9.2 [TuxCare] Security Update: gtk-update-icon-cache / gtk3 / gtk3-devel / gtk3-devel-docs / etc (ALMALINUX9.2:CLSA-2025:1745946091)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1745946091 advisory. - A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the...

PT-2026-103989

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

Rocky Linux 9 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (crlsa-2025_9526)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259526 advisory. linux-pam: Linux-pam directory Traversal CVE-2025-6020 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...