EUVD-2026-113260

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

RockyLinux 9 : skopeo (RLSA-2026:90462)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:90462 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

CVE-2026-107055

Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files...

CVE-2026-66090: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...

CVE-2026-107018: n/a: Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read…

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage...

EUVD-2026-112931

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage...

PT-2026-130634

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to...

PT-2026-132208

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...

openEQUELLA arbitrary file upload vulnerability

Versions of openEQUELLA prior to 2026.1 contain an arbitrary file upload vulnerability. This vulnerability arises because the image upload endpoint PUT /api/preloginnotice/image/name is not validated for file types prior to login; the Content-Type is set based on the filename. Users with...

RHEL 9 : podman (RHSA-2026:90362)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90362 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...

RHEL 9 : skopeo (RHSA-2026:90462)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90462 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...

RHEL 9 : buildah (RHSA-2026:90424)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:90424 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

OpenBMB XAgent security vulnerability

The OpenBMB XAgent v1.0.0 version contains a security vulnerability. This vulnerability stems from a directory traversal issue in the file upload handling within line 46 of ToolServer/ToolServerNode/main.py, potentially allowing attackers to access arbitrary files via path traversal...

Symlink Attack

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Symlink Attack via the networkStatsSingle function in lib/network.js when a network interface name containing path traversal sequences e.g. ../ is passed to networkStats o...

GHSA-M665-V7PM-7GRJ zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

Double Decoding of the Same Data

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Double Decoding of the Same Data via the serveStatic middleware in src/serve-static.ts, where a percent-encoded path sequence in a request URL is decoded by tryDecodeURI before the path...

GHSA-XWQ5-6CQP-VX96 Echo has a Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...

Echo has a Static Middleware Double-Unescape Path Traversal

Summary Commit a9ede66a PR 3006, issue 2599 silently fixed a path traversal vulnerability in the Echo web framework's static file middleware. Vulnerability The static middleware double-unescaped URL paths. Go's net/http already decodes Request.URL.Path, but middleware/static.go unconditionally...