PT-2026-127752

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

CVE-2026-108140: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal...

LaraDashboard 1.2.2 Path Traversal

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in core-upgrade backup handling, permitting a user with settings.edit to delete arbitrary files or restore an on-disk archive into application directories. The proof of concept verifies vulnerable source markers and...

PT-2026-127193

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

Linux Distros Unpatched Vulnerability : CVE-2026-116612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GStreamer Editing Services gst-editing-services. A GES project file can embed an arbitrary GStreamer pipeline description as an effect...

CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon (CENTOS8.4:CLSA-2026:1793098772)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793098772 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination...

Veeam Backup for Microsoft 365 authorization issue vulnerability

Veeam Backup for Microsoft 365 versions 8.0 through 8.5.0.1014 contain an authorization issue vulnerability. This vulnerability stems from improper permission control; users with the Veeam Backup for Microsoft 365 Administrator role can leverage LocalSystem privileges to read any file on the back...

CVE-2026-106077: Incorrect Authorization

A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges...

VulnCheck KEV: CVE-2024-3848

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

MiracleLinux 9 : lrzsz-0.12.20-58.el9_8 (AXSA:2026-2168:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2168:02 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

PT-2026-125871

Psono Server CE & EE versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download transfer to the upload endpoint, obtain a signed upload URL for an...

PT-2026-126691

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious...

PT-2026-126659

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal...

PT-2026-126618

Improper access control in the installer staging directory used by TeamViewer Full Client and Host prior to version 15.82 for Windows during installation of Advanced Asset Management allows a local authenticated user with low privileges to execute arbitrary commands as SYSTEM. An attacker can pla...

PT-2026-127207

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description A remote RSS feed can use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. This causes the...

PT-2026-127209

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description Thunderbird fails to validate the homeserver address received in the login response during Matrix account authentication. A compromised or malicious homeserver c...

PT-2026-126425

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

PT-2026-126640

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...

WatchGuard Fireware OS backlink vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions prior to 2025.1 through 2026.4, as well as versions 12.0 through 12.12.4 and 12.0 through 12.5.22. These vulnerabilities stem from an issue with external control file paths in firewall diagnostic commands. This allows remote...

SourceCodester Online Food Ordering System permission and access control issue vulnerability

The SourceCodester Online Food Ordering System version 1.0 contains a security vulnerability stemming from improper handling of the “image” parameter in the admin/addfood.php file. This flaw may allow unrestricted file uploads, enabling attackers to remotely upload malicious files...