CVE-2026-63343: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a metadata.yaml symlink pointing to an arbitrary host path allows an authenticated Incus user to read or overwrite any file on the host as root via the instance metadata API. The...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-17171

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or furth...

CVE-2026-16926

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

CVE-2026-16926 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

CVE-2026-16926 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

CVE-2026-70383

CVE-2026-70383 is a path traversal vulnerability in the Estonian Information System Authority (RIA) DigiDoc4 client , affecting versions 4.0.0 through before 4.11.0 . The flaw allows arbitrary file overwrite on the local system, as indicated by the CVELIST title. The CVSS 4.0 base score is 8.4 (H...

CVE-2026-70383 Arbitrary file overwrite vulnerability in DigiDoc4 client

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estonian Information System Authority RIA DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0...

WordPress Manual Image Crop plugin < 1.15 - Subscriber+ Arbitrary Attachment Image Overwrite via IDOR vulnerability

Subscriber+ Arbitrary Attachment Image Overwrite via IDOR vulnerability discovered by Shivamani Vastrala in WordPress Plugin Manual Image Crop versions 1.15...

GHSA-5F52-PX6M-C5HW vulnerabilities

Vulnerabilities for packages: wget...

CVE-2026-77113: Relative Path Traversal

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

Linux Distros Unpatched Vulnerability : CVE-2026-76219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that...

CVE-2026-53803

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation. Mitigati...

CVE-2026-49441

Wazuh versions 4.3.0 through 4.14.6 and 5.0.0-beta3 are affected by an arbitrary file write vulnerability in the cluster master component. The non-merged branch of process_files_from_worker() in framework/wazuh/core/cluster/master.py trusts a peer-controlled file_path key from files_metadata.json...

GHSA-7JX3-JQCP-HHGC Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree,...

Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree,...

CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

UBUNTU-CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...