CVE-2026-71426: Improper Limitation of a Pathname to a Restricted Directory

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is...

CVE-2026-51888

The langflow-ai langflow software, specifically versions up to 1.8.4 , is vulnerable to an absolute path traversal vulnerability in the knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge_base endpoint. The root cause is a lack of boundary enforcement in src/backend/base/la...

CVE-2026-51888: Improper Limitation of a Pathname to a Restricted Directory

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2024-58388: Improper Limitation of a Pathname to a Restricted Directory

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

CVE-2026-51888

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is:...

CVE-2026-64950: Improper Neutralization of Input During Web Page Generation

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

PT-2026-103768

Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...

CVE-2026-51873

Devika v1.0 is vulnerable to a Directory Traversal flaw within the Coder.save_code_to_project function. This vulnerability allows an attacker to manipulate file paths to write files outside the intended project workspace. While no direct exploit code is provided in the documents, a sighting was r...

PT-2026-103873

Name of the Vulnerable Software and Affected Versions Sharp and Toshiba Tec rebranded multifunction printers affected versions not specified Description An unauthenticated local file inclusion issue exists, allowing remote attackers to read arbitrary files. By manipulating the path parameter in t...

CVE-2026-51873

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

CVE-2026-51873: Improper Limitation of a Pathname to a Restricted Directory

Devika v1.0 is vulnerable to Directory Traversal in the Coder.savecodetoproject function, which allows attackers to write files outside the intended project workspace...

CVE-2026-79901: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

In deployments using BoKS keytab management, affected versions of bokskeytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change tim...

PT-2026-103946

Fortra BoKS Server Agent contains a predictable password generation vulnerability in the adjoin utility. Machine-account passwords generated during Active Directory join or password renewal operations may have significantly less entropy than intended, making them more susceptible to prediction by...

PT-2026-105171

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into user dn pattern without RFC 4514 DN escaping, allowing a...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

CVE-2026-58415: Files or Directories Accessible to External Parties

Internal state files accessible to external parties in moddavfs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebDAV dead properties of resources it cannot author via a GET request for the .DAV state directory This issue affects...

Apache HTTPD: CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

PT-2026-103931

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description Internal state files in the mod dav fs module are accessible to external parties. This allows a remote client to read WebDAV dead properties of resources they are not authorized to...

CVE-2026-56660: Cross-Site Request Forgery (CSRF)

GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_6911)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226911 advisory. dotnet: Nuget cache poisoning on Linux via world-writable cache directory CVE-2022-41032 Tenable has extracted the preceding description block directly from the CIQ...