PT-2026-102972

Name of the Vulnerable Software and Affected Versions Handlebars.java versions prior to 4.5.5 Description An issue allows directory traversal when using a Spring MVC application with a file: template prefix and a request-derived view name. In certain versions, template locations are validated as...

PT-2026-103098

Name of the Vulnerable Software and Affected Versions Product Designer App plugin for WordPress versions prior to 1.1.4 Description A Directory Traversal issue exists where unauthenticated attackers can read arbitrary files from the server, potentially exposing sensitive information. This is...

PT-2026-103603

Name of the Vulnerable Software and Affected Versions agent-zero versions 1.7 through 1.10 Description A directory traversal issue exists in the FileBrowser. init function within the python/helpers/file browser.py file. The FileBrowser class initializes using the host root directory as the...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.2:CLSA-2025:1751892809)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751892809 advisory. - An issue was discovered in decodeutf8 in base/gputf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ../...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2025:1741125595)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741125595 advisory. - Directory traversal vulnerability in the 1 extract and 2 extractall functions in the tarfile module in Python allows user-assisted remote...

CentOS Linux 6 [TuxCare] Security Update: libipa_hbac / libipa_hbac-devel / libsss_idmap / libsss_idmap-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1777683406)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1777683406 advisory. - The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that...

EUVD-2026-90417

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

EUVD-2026-90418

DB-GPT 0.8.0 contains directory traversal in skillupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py:40. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

PT-2026-103032

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-51864

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-51864

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1780064574)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1780064574 advisory. - All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an...

AlmaLinux 9.2 [TuxCare] Security Update: tar (ALMALINUX9.2:CLSA-2026:1769598463)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769598463 advisory. - GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the...

CentOS Linux 8.5 [TuxCare] Security Update: exim / exim-greylist / exim-mon / exim-mysql / exim-pgsql Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1788259973)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1788259973 advisory. - Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because...

PT-2026-103614

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 and 0.8.0 Description A directory traversal issue exists in the python file upload function within the endpoint packages/dbgpt-app/src/dbgpt app/openapi/api v1/python upload api.py:42. This allows a remote attacker to wri...

AlmaLinux 9.6 [TuxCare] Security Update: ctdb / ldb-tools / libldb / libldb-devel / libnetapi / etc (ALMALINUX9.6:CLSA-2026:1786093517)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786093517 advisory. - A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating...

CVE-2026-51864

The DB-GPT software (versions 0.7.5 and 0.8.0 ) contains a directory traversal vulnerability in the python_file_upload function, specifically located at packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42. A remote attacker can exploit this flaw to write files outside the inte...

CentOS Linux 7 [TuxCare] Security Update: babel / python-babel (CENTOS7:CLSA-2026:1777451880)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777451880 advisory. - Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files containing serialized Python objects via directory...

RHEL 9 : python3.9 (RHSA-2026:74087)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74087 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...