Thermo Fisher Torrent Suite Software

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

CVE-2026-88794: Improper Restriction of XML External Entity Reference

Enterprise Architect is vulnerable to XML External Entity XXE injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's...

CVE-2026-111093: Relative Path Traversal

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files...

CVE-2026-79824: Path Traversal: '\dir\..\filename'

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

Linux Distros Unpatched Vulnerability : CVE-2026-79824

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR...

UBUNTU-CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

Linux Distros Unpatched Vulnerability : CVE-2026-110859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch...

CVE-2026-110859

A flaw was found in GitPython. An argument injection vulnerability in the branch checkout mechanism allows a remote attacker to read arbitrary files from the host system. By enticing an application to clone and check out a repository with a specially crafted branch name, an attacker can cause...

CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

DEBIAN-CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-110859

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=, causing cloning...

CVE-2026-110690

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110690 Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110690 Cloud Commander 19.20.2 through 19.21.1 Path Traversal via GET /api/v1/pack

Cloud Commander cloudcmd versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root function instead of the root.resolve validation wrapper used elsewhere. Attackers can sen...

CVE-2026-110690

Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 are vulnerable to a path traversal vulnerability in the GET /api/v1/pack endpoint. The issue arises because the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrappe...

Security Bulletin: IBM Maximo Application Suite is vulnerable to a sensitive information disclosure

Summary IBM Maximo Application Suite login service could allow an unauthenticated user to access sensitive system information. This bulletin contains information regarding the vulnerabilities and their fix. Vulnerability Details CVEID:CVE-2026-105052 DESCRIPTION: IBM Maximo Application Suite 8.10...

CVE-2026-76519: Relative Path Traversal

A vulnerability in the Advanced Malware Protection AMP feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation...

VulnCheck KEV: CVE-2025-61624

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands...