DEBIAN-CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

CVE-2026-73255 is a path traversal vulnerability in Mongoose (an embedded web server and network library) prior to version 7.22 . The root cause is in the mg_ssi() function in src/ssi.c , which concatenates the #include or #include virtual directive argument into a filesystem path without calling...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

EUVD-2026-63499

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255 Mongoose: Path traversal in SSI #include directives enables arbitrary file read

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the tarball extraction logic in pkg/archive/extractor.go. An attacker can overwrite files outside the restore destination by supplying a malicious backup tarball with archive entries such as ../escape.txt...

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and...

ECHO-912C-D41A-C3C3 assert(has_sequence()) in HeifContext::get_track(). The whole sequence/ track API arrived in v1.20.0: 1.19.8 has no matches for has_sequence, get_track, m_tracks or heif_context_get_track, no libheif/sequences/ and no heif_sequences.h, and context.cc is 1572 lines while the upstream patch targets line 2115. nm -D on the shipped libheif.so exports no sequence/track symbol at all. Same basis as the six entries above. Note Debian still lists this open for trixie - the claim rests on the code evidence, not their triage.

Bulletin has no description...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.

Summary IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and...

Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed in IBM Business Automation Manager Open Editions 9.5.2 Vulnerability Details CVEID:CVE-2026-62389 DESCRIPTION: Rejected reason: This CVE ID has been rejected or withdrawn b...

perl-Date-Manip: Date::Manip for Perl: Denial of Service via CPU exhaustion in date parsing

A flaw was found in Date::Manip for Perl. An attacker could exploit a vulnerability in the parsetime function by providing a specially crafted input string containing long sequences of whitespace. This could lead to excessive CPU consumption due to inefficient processing, resulting in a Denial of...

Security Bulletin: Vulnerabilities exists in IBM Netezza Software

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in version 11.3.1.3. Vulnerability Details CVEID:CVE-2026-42013 DESCRIPTION: A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to...

OPENSUSE-SU-2026:21612-1 Security update for redis

This update for redis fixes the following issues: Changes in redis: - Update to 8.10.1 Update urgency: SECURITY: There are security fixes in the release. - Security fixes - CVE-2026-62356 Miscalculated buffer size in CMSketch RDB loading may lead to heap OOB write - Out-of-bounds access in TopK...

CVE-2026-77068

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

CVE-2026-77068

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...