Amazon Linux 2 : ipa, --advisory ALAS2-2026-3877 (ALAS-2026-3877)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3877 advisory. A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the...

MiracleLinux 8 : python3.12-3.12.14-1.el8_10 (AXSA:2026-1655:20)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1655:20 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

MiracleLinux 8 : python3-3.6.8-78.el8_10.ML.1 (AXSA:2026-1652:10)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1652:10 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

CVE-2026-77757: Improper Limitation of a Pathname to a Restricted Directory

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

Linux Distros Unpatched Vulnerability : CVE-2026-80535

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this...

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

CVE-2026-15990: Improper Limitation of a Pathname to a Restricted Directory

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frmgraph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

PT-2026-82231

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier Description The base directory used by the Sprin...

PT-2026-82097

Name of the Vulnerable Software and Affected Versions Formidable Charts versions prior to 2.0.2 Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By...

PT-2026-82151

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the XFS file system where the dirtree scrubber can detect a directory that refers to itself. In such cases, the directory tree repair code incorrectly attempts to appl...

ALSA-2026:60004 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...

CVE-2026-54550: Improper Limitation of a Pathname to a Restricted Directory

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes...

CVE-2026-80535: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: xfs: don't double-lock when deleting a self-referential directory LOLLM notices that the dirtree scrubber can detect a directory that refers to itself. In this case, it's not correct for the directory tree repair code to try to...

OPENSUSE-SU-2026:11600-1 389-ds-3.2.2+4b41542b2-1.1 on GA media

These are all security issues fixed in the 389-ds-3.2.2+4b41542b2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-82216

Name of the Vulnerable Software and Affected Versions ZLMediaKit affected versions not specified Description The downloadFile API endpoint fails to properly validate directory boundaries when restricting file access to configured root directories. The system uses a prefix comparison that does not...

CVE-2026-56547: Improper Input Validation

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded in them. The values cannot be changed later on, so the Apple profile generation page asks for those values and reflects...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: file-roller (UTSA-2026-030639)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030639 advisory. fr-archive-libarchive.c in GNOME file-roller through 3.36.1 allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098799)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098799 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix missing lastunlinktrans update when removing a directory When removing a directory we...

RHEL 10 : httpd (RHSA-2026:60004)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:60004 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server:...

RockyLinux 9 : httpd (RLSA-2026:59347)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59347 advisory. httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 Tenable has...