Rocky Linux 9 [CIQ] Security Update: fence-agents-aliyun / fence-agents-all / fence-agents-amt-ws / etc (crlsa-2025_11463)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202511463 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

AlmaLinux 9.2 [TuxCare] Security Update: squashfs-tools (ALMALINUX9.2:CLSA-2025:1751888935)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751888935 advisory. - squashfsopendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs...

Rocky Linux 8 [CIQ] Security Update: squashfs-tools / squashfs-tools-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_3139)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20243139 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic link...

Rocky Linux 9 [CIQ] Security Update: pam / pam-debuginfo / pam-debugsource / pam-devel / pam-docs (crlsa-2025_9526)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259526 advisory. linux-pam: Linux-pam directory Traversal CVE-2025-6020 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

CVE-2026-51874

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

CVE-2026-51874: Improper Limitation of a Pathname to a Restricted Directory

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

Rocky Linux 8 [CIQ] Security Update: mingw32-glib2 / mingw32-glib2-debuginfo / mingw32-glib2-static / etc Multiple Vulnerabilities (crlsa-2026_49512)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202649512 advisory. glib: GLib: Buffer underflow in GVariant parser leads to heap corruption CVE-2025-14087 glib: buffer over-read in glib/gvariant-serialiser.c via...

PT-2026-104034

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The save code to project function within the Feature Agent contains a path traversal flaw. This issue allows attackers to write files outside the designated project workspace, which could lead to a full server...

PT-2026-103912

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description Authenticated administrators can delete arbitrary directories by importing a specially crafted WPRIME/TAR package. The issue stems from insufficient path validation within th...

CVE-2026-55393: Improper Limitation of a Pathname to a Restricted Directory

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal...

CVE-2026-51882

The Langchain-Chatchat version 0.3.0 contains a path traversal vulnerability in its OpenAI-compatible file upload endpoint, /v1/files. An attacker can craft malicious filenames to write files to arbitrary locations outside the intended openai_files directory. This vulnerability has been exploited...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

CVE-2026-51873

Devika v1.0 is vulnerable to a Directory Traversal flaw within the Coder.save_code_to_project function. This vulnerability allows an attacker to manipulate file paths to write files outside the intended project workspace. While no direct exploit code is provided in the documents, a sighting was r...

CVE-2026-51880

The deeptutor 1.4.0 software contains a path traversal vulnerability within the EditFileTool.execute component. A remote caller can exploit this issue via the live tutorbot WebSocket interface to induce the tool layer to write or edit absolute paths outside the intended bot workspace. This vulner...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat versions 0.3.0 and 0.3.1 are vulnerable to a path traversal vulnerability (CWE-22 ). An attacker can inject path traversal sequences, such as ..\, into the knowledge_base_name parameter. This allows the attacker to b...

CVE-2026-51874

In Devika v1.0 , the Patcher Agent 's save_code_to_project function is susceptible to a path traversal vulnerability (CWE-22). This flaw allows an attacker to write files outside of the intended project workspace. The vulnerability has been observed in the wild, as evidenced by a sighting report....

CVE-2026-51875

In Devika v1.0 , a path traversal vulnerability exists within the Feature Agent save_code_to_project function. This flaw allows an attacker to write files outside the intended project workspace, which could potentially compromise the entire server. While a proof of concept is mentioned in the met...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...