CVE-2026-76315

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:48+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 23:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmuszamoh23...

CVE-2026-76313

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:43+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmrhqaepp2y...

Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure

Webmin before 1.290 and Usermin before 1.220 contain a path traversal caused by calling the simplifypath function before decoding HTML, letting remote attackers read arbitrary files, exploit requires sending crafted '..%01' sequences. id: CVE-2006-3392 info: name: Webmin 1.290 / Usermin 1.220 -...

GHSA-5F52-PX6M-C5HW vulnerabilities

Vulnerabilities for packages: wget...

GHSA-FXF9-RXPJ-26GX vulnerabilities

Vulnerabilities for packages: wget...

CVE-2026-66141 vulnerabilities

Vulnerabilities for packages: exim...

EUVD-2026-63135

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the filename argument passed to readfile, savetofile, or runpythonfile tool actions...

EUVD-2026-62934

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...

EUVD-2026-62923

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file...

EUVD-2026-62918

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could submit a crafted knowledge bundle delta to delete arbitrary files accessible to Splunk Enterprise on a cluster manager. This could affect system integrity and...

EUVD-2026-62909

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could write dispatch metadata to an arbitrary location on the host by supplying a crafted search identifier to a Representational State Transfer REST API endpoint a...

PT-2026-79053

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...

PT-2026-78990

Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...

PT-2026-79236

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

Linux Distros Unpatched Vulnerability : CVE-2026-76222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths...

PT-2026-79061

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

PT-2026-79088

An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Executi...

PT-2026-78989

Subscriber Arbitrary File Upload in IT Residence = 3.2.1 versions...

PT-2026-78991

Subscriber Arbitrary File Upload in Warehouse Cargo = 2.6.9 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-76219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that...