PT-2026-68047

Name of the Vulnerable Software and Affected Versions Audiobookshelf affected versions not specified Description An authentication bypass exists in the authentication-exemption check within server/routers/Auth.js. The system validates unauthenticated GET routes against req.path using a regex that...

PT-2026-68290

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass...

CVE-2026-18907: Relative Path Traversal

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-70615: Improper Neutralization of CRLF Sequences

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-8183: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot "...

CVE-2026-12609: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

ALSA-2026:50773 Important: ruby4.0 security, bug fix, and enhancement update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in...

PT-2026-68152

Name of the Vulnerable Software and Affected Versions Zigbee2MQTT affected versions not specified Description An issue exists in the ExternalJSExtension.getFilePath function within lib/extension/externalJS.ts where a name parameter received via the MQTT topic...

PT-2026-68292

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing dot-dot-slash /../ sequences, an attacker can view arbitrary file...

PT-2026-68091

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.66.0 through 1.73.1 Description The @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint. The system resolves the requested file path using the path.resolvelocalPath, filePath function...

PT-2026-68142

Name of the Vulnerable Software and Affected Versions Node-RED affected versions not specified Description The local-filesystem library storage module contains a path traversal flaw in the getLibraryEntry and saveLibraryEntry functions. This issue occurs because the user-supplied path parameter i...

PT-2026-68168

Name of the Vulnerable Software and Affected Versions Content Egg – Affiliate Product Importer & Price Comparison versions prior to 11.3.1 Description An arbitrary file deletion issue exists due to path traversal, where an attacker can use special character sequences to access and delete files...

ALSA-2026:50728 Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

PT-2026-68141

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description The compile program function in webserver/openplc.py fails to validate the file path variable when parsing FILE:path content directives from uploaded Structured Text .st program files. This allows an...

PT-2026-68024

Name of the Vulnerable Software and Affected Versions The-Pocket/PocketFlow affected versions not specified Description The pocketflow-coding-agent cookbook example implements a pathworkdir, p helper function that acts as a simple wrapper for os.path.joinworkdir, p without performing...

PT-2026-68053

Name of the Vulnerable Software and Affected Versions art-template affected versions not specified Description Sub-template resolution logic in src/compile/adapter/resolve-filename.js, utilized by the include and extend template directives, fails to verify if the resolved file path remains within...

PT-2026-67938

Name of the Vulnerable Software and Affected Versions com.talpa.hibrowser version 2.23.1.1 Description The download file feature contains a path traversal flaw on Android. This issue allows an attacker to perform arbitrary file writes by using directory traversal sequences within the filename...

ALSA-2026:50827 Important: ruby:4.0 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

ALSA-2026:50828 Important: ruby:3.3 security, bug fix, and enhancement update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command...

Security update for vifm (important)

openSUSE Security Update: Security update for vifm Announcement ID: openSUSE-SU-2026:0276-1 Rating: important References: 1273413 Cross-References: CVE-2026-8997 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description: This update for...