PT-2026-34195

Name of the Vulnerable Software and Affected Versions Hermes WebUI affected versions not specified Description An arbitrary file deletion issue exists in the '/api/session/delete' endpoint. Authenticated attackers can delete files outside the session directory by providing an absolute path or pat...

PT-2026-34118

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Microsoft Active Directory. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Orac...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011014)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011014 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Detect system inodes linked into directory hierarchy When UDF filesystem is corrupted, hidde...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-010872)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010872 advisory. In the Linux kernel, the following vulnerability has been resolved: bfs: Reconstruct file type when loading from disk syzbot is reporting that SIFMT bits of...

The vulnerability of the integrated Cisco Unity Connection messaging system, related to errors in the mechanism for processing relative path to the directory, allows a perpetrator to load arbitrary files.

The vulnerability of the integrated Cisco Unity Connection messaging system is related to errors in the mechanism for processing relative paths to the catalog. Exploiting this vulnerability allows a malicious actor to download arbitrary files from the vulnerable system...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011042)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011042 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible double unlock when moving a directory Tenable has extracted the preceding...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-010726)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-010726 advisory. An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the ODIRECTORY flag, and tries to open a regular file, nfsatomicope...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013284)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013284 advisory. An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the ODIRECTORY flag, and tries to open a regular file, nfsatomicope...

📄 7-Zip Directory Traversal / Remote Code Execution

This Metasploit local Windows exploit module targets a directory traversal vulnerability in 7-Zip versions prior to 25.00 that can be abused through a malicious ZIP archive to achieve arbitrary code execution when the archive is extracted...

Security update for plexus-utils (important)

openSUSE security update: security update for plexus-utils ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20535-1 Rating: important References: bsc1260588 Cross-References: CVE-2025-67030 CVSS scores: CVE-2025-67030 SUSE : 7.3...

Hermes Web UI 路径遍历漏洞

Hermes Web UI is a lightweight, dark-themed web interface developed by Nathan Esquenazi. Hermes Web UI has a path traversal vulnerability, which stems from a failure in trust boundaries. This vulnerability allows authenticated attackers to manipulate the workspace path parameters in endpoints suc...

Oracle Identity Manager Connector 安全漏洞

Oracle Identity Manager Connector is an identity management integration component developed by Oracle, a US-based company. Version 12.2.1.4.0 of Oracle Identity Manager Connector contains a security vulnerability. This vulnerability stems from issues with the Microsoft Active Directory components...

Linux Distros Unpatched Vulnerability : CVE-2026-40606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmprox...

Debian dla-4541 : opam - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4541 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4541-1 [email protected] https://www.debian.org/lts/security/...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013319)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013319 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a procfs host directory removal regression scsiprochostdirrm decreases a referenc...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013099)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013099 advisory. In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in procreaddirde Pde is erased from subdir rbtree through rberase, but not set...

EUVD-2026-23998

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...

CVE-2026-41294 OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...

CVE-2026-41294 OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

OpenClaw before 2026.3.28 loads the current working directory .env file before trusted state-dir configuration, allowing environment variable injection. Attackers can place a malicious .env file in a repository or workspace to override runtime configuration and security-sensitive environment...

CVE-2026-41294

OpenClaw is affected by CVE-2026-41294: versions before 2026.3.28 load the current working directory’s .env file during startup before trusted state-dir configuration, allowing environment variable injection that can override runtime configuration and security-sensitive environment settings. The ...