PT-2026-95568

This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failed wwids management bsc1277210. - SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows...

PT-2026-87209

Name of the Vulnerable Software and Affected Versions Windows PowerShell versions prior to September 2026 Patch Tuesday Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthorized attacker to bypass a security feature over a network....

PT-2026-87018

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

PT-2026-87310

Name of the Vulnerable Software and Affected Versions Microsoft Windows Search Component affected versions not specified Description An absolute path traversal issue exists in the Microsoft Windows Search Component. This flaw allows an authorized attacker to elevate privileges locally on the...

CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-87974

Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally...

PT-2026-88510

Impact The Elasticsearch and ElasticSecurity nodes built REST endpoints by interpolating user-provided identifiers straight into the request path. A value containing path separators or dot segments changed which endpoint the request actually reached, so an operation intended for one document coul...

PT-2026-87421

Name of the Vulnerable Software and Affected Versions Windows Shell affected versions not specified Description External control of a file name or path in Windows Shell allows an authorized attacker to elevate privileges locally, which can lead to unauthorized system impact. Recommendations At th...

PT-2026-88281

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network...

PT-2026-87614

Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

PT-2026-95347

This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failed wwids management bsc1277210. - SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows...

CVE-2026-77110: Improper Limitation of a Pathname to a Restricted Directory

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...

PT-2026-88273

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, also known as Pat...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

CVE-2026-53581: Improper Limitation of a Pathname to a Restricted Directory

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.420 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulatin...

CVE-2026-74239: Improper Limitation of a Pathname to a Restricted Directory

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-77104: Improper Limitation of a Pathname to a Restricted Directory

CommServe contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update CommServe...

PT-2026-87044

DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release. Update Content Extractor and Index Store...

PT-2026-87474

Name of the Vulnerable Software and Affected Versions Windows Compressed Folder affected versions not specified Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an authorized attacker to elevate privileges locally. Path traversal is a...

ROS-20260908-73-0093

The vulnerability of the Repo.clonefrom and Repo.clone functions in the git/repo/base.py module of the GitPython library for interacting with Git repositories is related to an incorrect path name limitation when processing the --separate-git-dir parameter. Exploiting this vulnerability could allo...