CVE-2026-78677: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

RockyLinux 10 : python3.12 (RLSA-2026:58902)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58902 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

AlmaLinux 10 : python3.12 (ALSA-2026:58902)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58902 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

RockyLinux 10 : python3.14 (RLSA-2026:58928)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58928 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

RockyLinux 9 : python3.12 (RLSA-2026:59009)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:59009 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

RockyLinux 9 : python3.14 (RLSA-2026:58901)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:58901 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

CVE-2026-77142: Missing Authorization

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

Critical: ipa

Issue Overview: A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name i...

ROS-20260825-73-0027

The vulnerability of the bnxtgetnvramdirectory function in the drivers/net/ethernet/broadcom/bnxt/bnxtethtool.c file of the Broadcom Ethernet network adapter driver for the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer...

PT-2026-82011

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...

PT-2026-82038

Cloudreve's remote download file paths can escape the selected destination directory in github.com/cloudreve/Cloudreve...

CVE-2026-78677: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.59 omits --separate-git-dir from unsafegitcloneoptions, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separategitdir parameter to Repo.clonefrom or Repo.clone to redirect repository metadata to an...

AlmaLinux 9 : python3.12 (ALSA-2026:59009)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59009 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descriptio...

AlmaLinux 10 : python3.14 (ALSA-2026:58928)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58928 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

AlmaLinux 8 : python3.12 (ALSA-2026:58971)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:58971 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descriptio...

CVE-2026-18547: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

PT-2026-85182

GitPython before 3.1.59 omits --separate-git-dir from unsafe git clone options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate git dir parameter to Repo.clone from or Repo.clone to redirect repository metadata to an...

CVE-2026-56707: Missing Authorization

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to...

PT-2026-81138

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.16 Description An issue exists where authenticated users with media management permissions can delete arbitrary files. This occurs because the deleteFile function in MediaUploadTrait only validates the basename of th...

ALSA-2026:59347 Low: httpd security update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in modldap per-directory configuration CVE-2026-29167 For more details about the securit...