CVE-2026-59732

A flaw was found in rclone, a command-line program for managing cloud storage. An attacker could craft a malicious archive that, when extracted by a user, allows files to be written outside the intended destination directory. This path traversal vulnerability could lead to the creation or overwri...

Vulnerabilities present in VMware products

VMware has identified vulnerabilities in VMware vCenter and VMware ESX products. VMware vCenter contains a critical authentication-bypass vulnerability in the Directory Service, with the identifier CVE-2026-59309. This vulnerability allows a malicious individual with network access to VMware...

CVE-2026-65943

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...

UBUNTU-CVE-2026-44943

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-44943

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-iscsi allows remote MITM attackers to create root-owned files outside the database and inject lines into the record. This issue affects open-iscsi: from through...

CVE-2026-65943

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...

CVE-2026-65943 Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...

EUVD-2026-50308

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI 9.11.0...

CVE-2026-65943

Joomla Extension RO CSVI by rolandd.com (

CVE-2026-64400

A flaw was found in the Linux kernel's ksmbd component. A vulnerability in the ksmbd component allows a remote authenticated attacker to bypass path restrictions. Specifically, a bug in the caseless retry logic during path resolution fails to properly handle directory traversal attempts. This...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

EUVD-2026-50216

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

The CVE-2026-59243 vulnerability affects the apache-airflow-providers-fab package before 3.7.3, where the FAB auth manager’s Azure AD OAuth login defaulted verify_signature=False when decoding the ID token. An attacker who can present a forged or unsigned (alg:none) ID token to the OAuth callback...

CVE-2026-64387

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

CVE-2026-63227

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...

[slackware-security] samba

New samba packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/samba-4.22.11-i586-1slack15.0.txz: Upgraded. This is a security release in order to address the following defects: TSIG packet with name compressi...

Linux Distros Unpatched Vulnerability : CVE-2026-58222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing...

RockyLinux 9 : plexus-utils (RLSA-2026:38796)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:38796 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

SUSE SLES15: ctdb / libsamba-policy-devel / libsamba-policy-python3-devel / etc (SUSE-SU-2026:3362-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3362-1 advisory. This update for samba fixes the following issues - CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS...

CVE-2026-66063

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...