CVE-2026-85487: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-5049: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-75875: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

PT-2026-108210

Name of the Vulnerable Software and Affected Versions Satel Netco Design versions prior to 2.1.7 Description A relative path traversal issue exists in the data export functionality. This allows an authenticated user with Viewer privileges to write attacker-influenced content to file system...

sssd security update

2.12.0-3.0.1.el102.2 - Restore default debug level for ssscache Orabug: 32810448 2.12.0-3.2 - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in evalaccesstokenbuf 2.12.0-3.1 - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tre...

PT-2026-108040

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585: Improper Limitation of a Pathname to a Restricted Directory

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

EulerOS 2.0 SP15 : attr (EulerOS-SA-2026-3898)

According to the versions of the attr packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate...

EulerOS 2.0 SP15 : acl (EulerOS-SA-2026-3962)

According to the versions of the acl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, a...

MiracleLinux 8 : tar-1.30-13.el8_10 (AXSA:2026-1944:04)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1944:04 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X...

CVE-2026-84247: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

Debian dla-4829 : rails - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4829 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4829-1 [email protected]...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

EulerOS 2.0 SP15 : acl (EulerOS-SA-2026-3896)

According to the versions of the acl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions aclgetfile, aclsetfile, aclextendedfile, a...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-3944)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

Security Bulletin: Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Summary Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-105820

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-105820 Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy Resolution

Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability...

CVE-2026-105820

The Vault ACL policy cache is vulnerable to a path traversal flaw (CWE-22) when policy names contain specific traversal constructs. This allows a token with a specially crafted policy name to bypass namespace boundaries and utilize the capabilities of policies defined in other namespaces, includi...