Astra Linux – Vulnerability in python-setuptools

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability exists in Setuptools prior to version 78.1.1. An attacker could be allowed to write files to arbitrary locations on the file system with the permissions of...

CVE-2026-110734

Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR .hdr image decoder modules/hdr/imageloaderhdr.cpp. The run-length decoding loop expands RLE instructions read from the file into a buffer sized from the image dimensions, without validating that an instruction's...

CVE-2026-5049

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-95140: Improper Limitation of a Pathname to a Restricted Directory

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

PT-2026-106803

kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

CVE-2026-51884

The Langchain Chatchat 0.3.1 software contains a path traversal vulnerability in the /knowledge_base/upload_temp_docs temporary document upload endpoint. An attacker can exploit this by crafting malicious filenames to write files to arbitrary locations on the server, effectively bypassing intende...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10031)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510031 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2025_10136)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510136 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (crlsa-2025_10128)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510128 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10189)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510189 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 10.0 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2025_10140)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510140 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10148)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510148 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

Rocky Linux 8 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_10026)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202510026 advisory. cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4435 cpython: Bypass extraction filter to modify file metadata outside extraction...

CVE-2026-100838

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

CVE-2026-100838 Contrast before 1.19.1 CopyFile Policy Symlink Subversion

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

CVE-2026-100838: Improper Link Resolution Before File Access

Contrast is a confidential-computing runtime for Kubernetes. In versions before 1.19.1, the Kata agent policies generated by the Contrast CLI contained a flaw in the CopyFile verification that allowed arbitrary writes to the guest root filesystem. A malicious process on the untrusted host able to...

EUVD-2026-87201

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

CVE-2026-94445

Independent deployments of golang.org/x/playground are vulnerable to Remote Code Execution (RCE) due to a combination of two flaws. A malicious txtar can escape its execution context to perform arbitrary writes to the playground host's trusted filesystem. Concurrently, a failure to restrict the e...

CVE-2026-94445 Malicious user input may lead to RCE in golang.org/x/playground

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...