CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73291

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs

Summary IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs. This bulletin provides patch information to address the vulnerabilities Vulnerability Details CVEID:CVE-2026-48779 DESCRIPTION: ws is ...

CVE-2026-72913

A flaw was found in Kitty, a cross-platform GPU based terminal. This vulnerability allows an attacker to achieve arbitrary code execution by chaining specific escape sequences @kitty-echo and @kitty-ssh when a user displays untrusted terminal data. These sequences write unauthenticated data to th...

Improper Neutralization Of Argument Delimiters (Argument Injection)

Apache Camel is vulnerable to Improper Neutralization of Argument Delimiters. The vulnerability is due to insufficient validation of custom CLI arguments and path values supplied through Camel headers, which allows an attacker who can influence these values to inject unintended docling command-li...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

EUVD-2026-57008

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decodepointerinplace function within cJSONUtils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

CVE-2026-64826: Improper Limitation of a Pathname to a Restricted Directory

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport method. Attackers can craft requests with ../ sequences to escape th...

Black Hat USA 2023 Conference Slides

Black Hat USA 2023 conference slides for topics Does Public Disclosure of Vulnerabilities Affect Hacker Participation in Bug Bounty Programs?, Diversity Microtalks: Perspectives on Creating Change, ODDFuzz: Hunting Java Deserialization Gadget Chains via Structure-Aware Directed Greybox Fuzzing,...

PT-2026-71114

Name of the Vulnerable Software and Affected Versions Seerr versions prior to 3.4.0 Description The ImageProxy component in server/lib/imageproxy.ts uses upstream ETag and Content-Type response headers to create cache filenames for the unauthenticated GET '/avatarproxy/:jellyfinUserId' endpoint. ...

CVE-2026-66898: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploi...

TencentOS Server 4: sssd (TSSA-2026:0827)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0827 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-71202

Name of the Vulnerable Software and Affected Versions Joomla version 6.1.1 Description A path traversal issue exists in the com joomlaupdate extension. A Super User can be tricked into extracting a specially crafted archive containing absolute paths or directory traversal sequences in ZIP entry...

PT-2026-71308

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description A path traversal vulnerability exists during backup import and restore operations. The issue occurs because the software fails to validate instance and storage volume names within the archive...

CVE-2026-73291: Improper Limitation of a Pathname to a Restricted Directory

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

PT-2026-71339

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export method. By using ../ sequences, an attack...