SUSE CVE-2026-82251

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

SUSE CVE-2026-84373

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without...

PT-2026-85305

Name of the Vulnerable Software and Affected Versions MOOS-IvP versions prior to 24.8.2 Description The SplitHandler fails to properly validate variable names extracted from alog files. On Windows systems, an attacker can provide specially crafted alog files containing backslash sequences in...

PT-2026-85014

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

PT-2026-86455

Name of the Vulnerable Software and Affected Versions RouterOS versions prior to 6.49.21 RouterOS versions prior to 7.23.4 RouterOS versions prior to 7.24.2 Description WebFig contains an unauthenticated file-read issue in the '/jsproxy' endpoint. A newly allocated session retains a stale...

CVE-2026-82521: Improper Limitation of a Pathname to a Restricted Directory

parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes...

CVE-2026-85396: Improper Limitation of a Pathname to a Restricted Directory

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85456: Improper Limitation of a Pathname to a Restricted Directory

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and...

CVE-2026-75602: Improper Limitation of a Pathname to a Restricted Directory

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-78069: Missing Authorization

Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - J2StoreControllerApps's appTask delegation path instantiates app-plugin controllers with no ACL check anywhere in the code. It currently returns 403...

CVE-2026-85199: Improper Limitation of a Pathname to a Restricted Directory

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

CVE-2026-85160: External Control of File Name or Path

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

CVE-2026-85124: Improper Limitation of a Pathname to a Restricted Directory

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

PT-2026-85250

Name of the Vulnerable Software and Affected Versions parsedmarc versions 9.0.6 through 11.0.0 Description The software writes forensic report sample files using an output path derived from the email subject. If the subject consists entirely of path traversal sequences sequences used to access...

VulnCheck KEV: CVE-2024-4956

Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1...

PT-2026-85043

Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers used to create, update, or delete Self-orchestrator resources were incorporated into filesystem paths without adequate validation or sanitization. An...

PT-2026-84992

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal...

PT-2026-84985

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...

PT-2026-85229

Name of the Vulnerable Software and Affected Versions rubyzip versions prior to 3.4.0 Description An issue exists in the Zip::Entryextract function that allows for path traversal. The software fails to properly validate extraction paths when using prefix comparison without trailing separators. Th...

Oracle Linux 10 : ELSA-2026-61586-0: / tar (ELSA-2026-615860)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615860 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...