CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

CVE-2026-55591

Signal K Server (signalk-server, a boat central-hub server application) versions up to 2.27.0 contain a Server-Side Request Forgery (SSRF) in makeRemoteRequest() within src/serverroutes.ts. The function accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters via the testSign...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 12 Vulnerability Details CVEID:CVE-2026-12143 DESCRIPTION: form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the field argument to FormDataappend a...

EUVD-2026-78660

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

CVE-2026-91989 atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

CVE-2026-91989 atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

CVE-2026-91989

CVE-2026-91989 is a path traversal in the atomic-agents-stack dashboard HTTP server (all versions through 1.0.0). The DashboardHandler.do_GET endpoint in dashboard/serve.py builds filesystem paths directly from the request without routing through _io.safe_resolve_under, allowing literal ../ segme...

CVE-2026-91989 atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

CVE-2026-55828

go.qbee.io/transport , a remote access transport protocol implementation, is affected by a symlink-chain path traversal in its extractTar routine prior to v1.26.25 . The root cause is that path validation is strictly lexical and does not account for on-disk symlinks created earlier during extract...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

EUVD-2026-78783

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

USN-8766-1 suricata-update vulnerability

Guillem Lefait discovered that Suricata-Update did not properly validate destination paths when extracting files referenced by downloaded rule archives. An attacker could possibly use this issue to write arbitrary files outside the configured rules directory...

EUVD-2026-78781

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-87791

A path traversal vulnerability in the reserved_file_check function of functions.php in the WordPress Design SCUOLE Italia theme (versions 2.6.0–2.18.1 ) allows an unauthenticated attacker to download arbitrary files accessible by the web server process. The CVSS 4.0 base score is 8.7 (HIGH) , ref...

CVE-2026-87791 Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme

A path traversal vulnerability exists in the reservedfilecheck function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerability allows an unauthenticated attacker to download arbitrary files accessible by the web server process...

CVE-2026-50024 GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server

GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, addheadfiletasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto tempdst/.git/logs/, allowing a malicious server to make GitHacker read an arbitra...