Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124467 advisory. On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when...

PT-2026-97700

Name of the Vulnerable Software and Affected Versions ShopXO versions prior to 2.2.8 Description A path traversal issue exists in the Ueditor Upload Interface component within the config/ueditor.php file. A remote attacker can exploit this by manipulating the path type argument, allowing them to...

CVE-2026-48541: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

PT-2026-97733

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description Path Traversal in DIAEnergie. Path Traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables...

PT-2026-97841

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to execute arbitrary commands. Path traversal is a flaw that allows an attacker to access files and directories that...

PT-2026-97915

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.2.6 DbGate versions prior to 7.3.2-premium-beta.1 Description A path traversal issue exists in the files-style endpoint. Remote attackers can manipulate the filePath/uri argument used by the fs.readFile function with...

OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure

Publicly exposed large language model LLM infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and...

PT-2026-98237

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...

PT-2026-97849

Name of the Vulnerable Software and Affected Versions pulpcore affected versions not specified Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL...

PT-2026-98259

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.09 Description A path traversal issue exists in the File Upload component. This occurs within the getOriginalFilename function located in the...

CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...

VulnCheck KEV: CVE-2026-30633

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-97323: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

RHEL 8 : acl (RHSA-2026:71656)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71656 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

CVE-2026-78312: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

PT-2026-97694

Name of the Vulnerable Software and Affected Versions MantisZip versions prior to 0.4.6 Description A path traversal flaw exists in the Preview component within the MainWindow.UI.cs file. The issue occurs in the Path.Combine function, allowing a remote attacker to manipulate file paths to access...