CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82264 Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

EUVD-2026-67795

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

Security update for apptainer

This update for apptainer fixes the following issue: CVE-2026-17106: github.com/moby/go-archive: tar extraction routines do not confine filesystem operations to the destination directory and allow for arbitrary file writes bsc1275248. Patch Instructions: To install this SUSE update use the SUSE...

SUSE-SU-2026:3863-1 Security update for apptainer

This update for apptainer fixes the following issue: - CVE-2026-17106: github.com/moby/go-archive: tar extraction routines do not confine filesystem operations to the destination directory and allow for arbitrary file writes bsc1275248...

WordPress Advanced File Manager plugin < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui vulnerability

Authenticated Arbitrary File Read and Write via fmaloadfmaui vulnerability discovered by Christian Kold Jensen in WordPress Plugin Advanced File Manager versions 5.4.13...

CVE-2026-80663

CVE-2026-80663 affects the Linux kernel's tools/power/x86/intel-speed-select daemon. The vulnerability is a symlink-based pidfile clobbering flaw: the daemon uses a fixed pidfile path under /tmp and opens it without O_NOFOLLOW, allowing a local unprivileged user to pre-create a symlink at that pa...

CVE-2026-61800

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...

CVE-2026-40541: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

WS-2026-0031

NocoBase is vulnerable to authenticated remote code execution through two chained flaws in the server package. An authenticated admin can supply an unsanitized documentRoot value to the storages:update API to redirect the file-upload storage root to an arbitrary path on disk, including the...

PT-2026-89230

GHSA-7fj9-65v4-rp7h: Arbitrary file write on host via image-planted symlinks and oci.dns. newline injection...

PT-2026-83287

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

PT-2026-83253

Name of the Vulnerable Software and Affected Versions aqua versions prior to 2.60.1 Description In the handler.HandleFile function within pkg/unarchive/archives.go, the software fails to verify that the target of a symlink created via os.Symlink remains within the intended extraction destination....

PT-2026-83309

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-55569: Improper Limitation of a Pathname to a Restricted Directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-82264: Improper Limitation of a Pathname to a Restricted Directory

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary...

CVE-2026-82286: Improper Limitation of a Pathname to a Restricted Directory

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-55220: Deserialization of Untrusted Data

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefinition\Data\Hotspotimage::getDataFromResource in models/DataObject/ClassDefinition/Data/Hotspotimage.php passes the field hotspots object-store column to...

PT-2026-83114

Name of the Vulnerable Software and Affected Versions Plesk for Linux versions 18.0.34 through 18.0.79.8 Description A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to...