PT-2026-64317

Name of the Vulnerable Software and Affected Versions BlenderMCP versions prior to commit 30a3308 Description A path traversal issue exists in the download polyhaven asset function. This flaw allows attackers to write arbitrary files by injecting traversal sequences into API response include keys...

PT-2026-64427

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists in the chunked transfer encoding parser of libsoup. The parser uses a permissive function for chunk sizes that accepts inputs violating RFC 9112, such as leading whitespace, plu...

PT-2026-64443

Name of the Vulnerable Software and Affected Versions pymdown-extensions version 10.21.3 Description The b64 extension inlines images referenced by as base64 data URIs. The repl path function in pymdownx/b64.py fails to verify that the resolved path remains within the configured base path. An...

PT-2026-64320

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory travers...

CVE-2026-66004: Improper Limitation of a Pathname to a Restricted Directory

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

PT-2026-105473

Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file name values with directory traversal...

PT-2026-105479

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download polyhaven asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

PT-2026-71667

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An unauthenticated remote attacker can cause a denial of service by sending repeated / sequences to the decode function within...

PT-2026-64365

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the LoongArch architecture where the stop this cpu function marks CPUs as offline for the scheduler using set cpu onlinefalse but fails to notify the Read-Copy-Update...

Security update for net-tools (low)

openSUSE security update: security update for net-tools ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21429-1 Rating: low References: bsc1254323 Cross-References: CVE-2024-58251 CVSS scores: CVE-2024-58251 SUSE : 2.8...

Directory Traversal

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Directory Traversal via the ServeStaticFileController process. An attacker can access sensitive files by supplying directory traversal sequences in the path parameter of ...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the extractTo function. An attacker can overwrite or create files outside the intended extraction directory by supplying crafted entryName arguments remotely. Details A Directory Traversal attack also known as pa...

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

Directory Traversal

Overview io.kubernetes:client-java is a Client Java package. Affected versions of this package are vulnerable to Directory Traversal via the copyDirectoryFromPod process when enableTarCompressing is set to false. An attacker can create files in arbitrary locations on the client machine by...

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

CVE-2026-65694

Microweber CMS up to version 2.0.20 is affected by a path traversal in the static file controller. The vulnerability allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter, exploiting normalize_path() failure to strip...

CVE-2026-65694 Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

CVE-2026-65694 Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

CVE-2026-65694 Microweber CMS 2.0.20 Path Traversal via ServeStaticFileController

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...