CVE-2026-51880: Improper Limitation of a Pathname to a Restricted Directory

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

PT-2026-104042

The /knowledge base/upload temp docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...

PT-2026-105905

Impact RestrictedPython could allow a sandbox escape when a policy exposes the standard library string module, or otherwise exposes string.Formatter, to restricted code. string.Formatter field resolution methods such as get field can perform attribute and item traversal internally and return live...

PT-2026-105844

Summary The upload attachment tools in both Confluence and Jira accept arbitrary file paths without path traversal validation. The upload attachment methods read any file accessible to the server process and upload it to a Confluence page or Jira issue. Despite the existence of a validate safe pa...

CVE-2026-51873

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1752088672)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1752088672 advisory. - A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated regist...

Rocky Linux 9 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_20945)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202520945 advisory. vim: Vim path traversal CVE-2025-53906 vim: Vim path traversial CVE-2025-53905 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: cpio (ALMALINUX9.2:CLSA-2026:1786620962)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786620962 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp (crlsa-2022_4661)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20224661 advisory. sinatra: path traversal possible outside of publicdir when serving static files CVE-2022-29970 Tenable has extracted the preceding description block directly from t...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2025_14900)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514900 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8194...

Rocky Linux 10.2 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (crlsa-2026_41937)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202641937 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd:...

AlmaLinux 9.6 [TuxCare] Security Update: cpio (ALMALINUX9.6:CLSA-2026:1786621771)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786621771 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1788959958)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1788959958 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended modu...

CentOS Linux 6 [TuxCare] Security Update: rsync (CENTOS6:CLSA-2025:1751134987)

The CentOS Linux 6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1751134987 advisory. - A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent fr...

Rocky Linux 8 [CIQ] Security Update: file-roller / file-roller-debuginfo / file-roller-debugsource (crlsa-2021_4179)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214179 advisory. file-roller: directory traversal via directory symlink pointing outside of the target directory incomplete fix for CVE-2020-11736 CVE-2020-36314 Tenable has extract...

Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2025_11463)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511463 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: squashfs-tools (ALMALINUX9.2:CLSA-2025:1751888935)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751888935 advisory. - squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs...

Rocky Linux 8 [CIQ] Security Update: squashfs-tools / squashfs-tools-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3139)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243139 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...

Rocky Linux 9 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (crlsa-2025_9526)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259526 advisory. linux-pam: Linux-pam directory Traversal CVE-2025-6020 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...