PT-2026-97402

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

PT-2026-97599

Name of the Vulnerable Software and Affected Versions OpenShift console affected versions not specified Description An unauthenticated attacker can exploit a path traversal flaw by manipulating the lng and ns query parameters in the '/locales/resource.json' endpoint. This allows the attacker to...

CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

CVE-2026-96275: Improper Limitation of a Pathname to a Restricted Directory

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-15358: Unquoted Search Path or Element

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

CVE-2026-79304: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79306: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

Linux Distros Unpatched Vulnerability : CVE-2026-96276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension...

Linux Distros Unpatched Vulnerability : CVE-2026-96275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On syste...

TencentOS Server 4: bubblewrap (TSSA-2026:1022)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1022 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile impo...

Wireshark 4.6.x < 4.6.7 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.7 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profi...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory. - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path...

Foxit PDF Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

PT-2026-97347

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A malicious or compromised repository can write attacker-controlled content to arbitrary locations on the host filesystem. This occurs through the extract extra data function. On system...

PT-2026-97613

Name of the Vulnerable Software and Affected Versions weiqingwen spring-boot-forum versions up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f Description A path traversal issue exists in the Avatar Upload component. A remote attacker can exploit this by manipulating the Username argument within the...

PT-2026-97591

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description A remote attacker can perform directory traversal on the system by sending a specially crafted URL request containing dot-dot-slash /../ sequences. This allows the attacker to view arbitrary...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...