Jenkins LTS < 2.580.2 / Jenkins weekly < 2.588 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.580.2 or Jenkins weekly prior to 2.588. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape...

Rocky Linux 10.2 [CIQ] Security Update: skopeo / skopeo-debuginfo / skopeo-debugsource / skopeo-tests Multiple Vulnerabilities (crlsa-2026_89761)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689761 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_89859)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689859 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary wri...

MiracleLinux 9 : skopeo-1.22.2-9.el9_8 (AXSA:2026-2182:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2182:06 advisory. podman: Arbitrary file write when importing OCI archive CVE-2025-11395 net/http: golang: golang: Denial of Service via crafted HTTP Range headers...

Linux Distros Unpatched Vulnerability : CVE-2026-112946

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in...

Juniper Networks Session Smart Router path traversal vulnerability

A path traversal vulnerability exists in Juniper Networks Session Smart Router and Juniper Networks Session Smart Conductor versions prior to 7.0.5, from 7.1.0 up to but including 7.1.7, and from 7.2.0 up to but including 7.2.3. This vulnerability stems from improper restrictions on pathnames...

Pie Register Premium arbitrary file upload vulnerability

Versions 3.8.4.0 and earlier of Pie Register Premium contain an arbitrary file upload vulnerability. This vulnerability arises because the pieregfileupload function fails to validate calls to file type checks, and the AJAX handler lacks nonce validation or permission checks. As a result,...

PT-2026-127798

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose...

PT-2026-127799

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page image or cat image parameters to the web-accessible /public/image...

PT-2026-128303

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

PT-2026-128279

An Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of...

PT-2026-129174

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0 Description Static file handlers can normalize dot segments after route matching, allowing an unauthenticated attacker to read files intended to be protected by route-level middleware...

PT-2026-127873

The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.31.0 via the 'image any body field referenced by the ImageHelper node's mix tag' parameter...

CVE-2026-103407: Juniper Networks: An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks…

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the...

WordPress IvyForms arbitrary file upload vulnerability

WordPress IvyForms versions 1.5.1 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient file type validation in the filterFiletypeAndExt function; it lacks a list of prohibited extensions and overrides WordPress’s built-in MIME and extension...

CVE-2026-117615: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being renamed, allowing attackers with Item/Create and Item/Configure permission to read arbitrary files on the Jenkins controller file system...

Axel Download Accelerator Axel path traversal vulnerability

Axel Download Accelerator: Versions 2.17.14 and earlier of Axel contain a path traversal vulnerability. This vulnerability arises because after parsing a URL and extracting the filename, the output filename is URL percent decoded via httpdecode. Attackers can insert sequences such as %2e%2e%2f in...

Linux Distros Unpatched Vulnerability : CVE-2026-118177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations...

Rocky Linux 10.2 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_89849)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202689849 advisory. flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin CVE-2026-97023 flatpak: flatpak: Arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2026-116673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied...