Linux Distros Unpatched Vulnerability : CVE-2026-77642

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for...

PT-2026-79379

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

PT-2026-79358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Authenticated administrators can perform path traversal by using directory traversal sequences in the Bazaar install and uninstall endpoints. By providing crafted values for the packageName parameter,...

Nimux 1.0.6

Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...

CVE-2026-76611: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo 4.1.66...

PT-2026-84068

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affect...

CVE-2026-48105: Improper Limitation of a Pathname to a Restricted Directory

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

Linux Distros Unpatched Vulnerability : CVE-2026-73259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using...

Linux Distros Unpatched Vulnerability : CVE-2026-73255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI- enabled file can place directory traversal sequences ...

PT-2026-79964

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run id or model id after validate source run or validate source model in mlflow/server/handlers.py verifies only path containment, allowin...

openSUSE 16 Security Update : python-unearth (openSUSE-SU-2026:21606-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21606-1 advisory. Changes in python-unearth: - CVE-2026-73030: iswithindirectory function fails to normalize paths before validation and allows ../ sequences to bypass...

SUSE SLES15 Security Update : podman (SUSE-SU-2026:3652-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3652-1 advisory. - CVE-2026-55686: specially crafted image where the WORKDIR path contains a symlink allows for directory creation and ownership...

CVE-2026-67361: Cross-Site Request Forgery (CSRF)

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

PT-2026-79436

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted...

PT-2026-80200

Summary Atlantis versions = 0.19.8 and 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended...

Linux Distros Unpatched Vulnerability : CVE-2026-73254

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored...

PT-2026-79424

Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45 Description Template functions readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that fail to resolve...

MINI-P65W-6VWF-H5R5

Bulletin has no description...

DEBIAN-CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...

CVE-2026-77642

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019...