PT-2026-132413

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0, the repo-server evaluates .jsonnet files with an importer that does not confine import, importstr, or importbin to the repository root. Absolute paths, parent-directory...

PT-2026-132492

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the builtin creator calls ensure dir for executable, library, and package directories, and ensure dir accepts an existing symlink to a directory because exists follows it. Interpreter creation, seed...

CVE-2026-104312: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...

PT-2026-130607

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT SYSTEM SETTINGS permission can upload an HTML fi...

Progress Software WS_FTP Server path traversal vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.6 and 2025.0.3 contain a path traversal vulnerability. This vulnerability stems from improper path name restrictions in the Ad Hoc Transfer component, potentially allowing authenticated users to access files outside the intended directory...

CVE-2026-107018

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage...

PT-2026-132783

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk versions: 9.6.1. A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-107053: n/a: Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write…

Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox...

PT-2026-132797

Name of the Vulnerable Software and Affected Versions WiFiman Desktop affected versions not specified Description A local actor with low privileges can exploit an External Control of File Name or Path issue to execute arbitrary commands with root privileges on the host device. External Control of...

CVE-2026-9535: vtk: A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1)

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk versions: 9.6.1. A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-107018

Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage...

PT-2026-132385

Name of the Vulnerable Software and Affected Versions Librera PDF Reader version 7222 Description Insecure permissions allow unauthorized attackers to arbitrarily write to and truncate files within a shared storage space located outside of the application sandbox. This can lead to the alteration ...

CVE-2026-119198: nuxt: Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with TCP access to an exposed Nuxt development server can send a nuxt:dev:client-error event over the HMR socket with an absolute file path at the end of its message. The development server reads that fi...

RHEL 9 : mrtg (RHSA-2026:91644)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:91644 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

Debian dla-4869 : libvlc-bin - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4869 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4869-1 [email protected]...

RockyLinux 10 : emacs (RLSA-2026:90887)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:90887 advisory. emacs: GNU Emacs: Arbitrary code execution upon opening a file CVE-2026-96269 Tenable has extracted the preceding description block directly from the RockyLinux...

Important: aspell security update

GNU Aspell is a spell checker designed to eventually replace Ispell. It can either be used as a library or as an independent spell checker. Security Fixes: aspell: aspell: Arbitrary code execution via crafted dictionary file CVE-2026-103658 For more details about the security issues, including th...

Linux Distros Unpatched Vulnerability : CVE-2026-112375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated Kafka principal with no authorization grants not even ALTERCONFIGS can make a broker read a file or an environment variable from the broker hos...

CVE-2026-107052

The ProjectMAXS MAXS Module FileRead (versionCode 27) contains a vulnerability due to insecure permissions within its AIDL interface . This flaw allows unauthorized attackers to bypass the sandbox and arbitrarily read files by providing an absolute path . While the technical impact is categorized...

PT-2026-132865

Name of the Vulnerable Software and Affected Versions Xcode versions prior to 27.2 Description An app may be able to read arbitrary files due to improper handling of symlinks symbolic links, which are files that point to another file or directory on the system. Recommendations Update to Xcode...