CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an absolute-path traversal vulnerability that allows a remote, authenticated attacker to obtain sensitive information. The IBM-assigned CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high imp...

PYSEC-2026-3810 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

Summary DirectoryPromptRegistry.set interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory. Details...

PT-2026-89635

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-69612

Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-68896

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

EUVD-2026-73680

Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally...

CVE-2026-68896

CVE-2026-68896 is an absolute path traversal vulnerability in the Microsoft Windows Search Component that allows an authorized local attacker to achieve privilege escalation . The vulnerability requires low privileges, no user interaction, and has low attack complexity, with a CVSS 3.1 base score...

EUVD-2026-73543

Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

CVE-2026-69612

CVE-2026-69612 is an absolute path traversal vulnerability in Windows Error Reporting that allows an authorized attacker to elevate privileges locally . The flaw resides in how the component handles file paths, permitting traversal beyond the intended directory. The CVSS 3.1 score is 7.8 (HIGH) w...

DEBIAN-CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EUVD-2026-72559

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious...

PT-2026-87614

Absolute path traversal in Windows Error Reporting allows an authorized attacker to elevate privileges locally...

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

CVE: This vulnerability corresponds to CVE-2026-72802. Summary POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when...

PT-2026-84299

appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write file and write files batch tools, allowing attackers to write files outside the intended PROJECT ROOT directory. Attackers can supply absolute paths or relative paths with parent directory segments to overwrit...

PT-2026-83557

Name of the Vulnerable Software and Affected Versions browser-use web-ui versions 2.0.0 through 3.0.0 Description The software fails to validate browser settings paths within the run agent task function. This allows unauthenticated users to create directories at arbitrary locations on the system...

CVE-2026-40526

Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/path endpoint. The path route parameter is passed directly to filegetcontents without...

PT-2026-82672

Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint...

EUVD-2026-66606

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

PYSEC-2026-3790

NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. loadlangngrams joins the corpus root with crubadancode, the column-0 value read from the corpus table.txt mapping file, and opens the result with the builtin open rather than the pathsec-validated opener, s...