PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...

Zimbra Collaboration Suite authorization issue vulnerability

Zimbra Collaboration Suite versions 10.1.20 and earlier contain an authorization issue vulnerability. This vulnerability arises because FileSharedWithMeRequest requests bypass the authorization check for delegated accounts. Without proper validation of document sharing, the system accepts file...

Node.js Node permissions and access control issues vulnerability

Node.js versions 26.12.0 and earlier contain a permission and access control vulnerability. This issue stems from improper enforcement of the permission model on the file system: when a request path is shorter than the wildcard authorization prefix, the base tree search stops comparing early and...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because the system fails to detect the status of file extension attributes during the early stages of reading a read-only file system; as a...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.9. It stems from xfs’s improper handling of the reflink flag during swap mapping, causing subsequent writes to shared blocks not to be performed via copy-on-write. This may result in corruption of other files sharing those blocks...

CGM CLININET authorization issue vulnerability

CGM CLININET versions 2026.MS3 and earlier contain an authorization issue vulnerability. This vulnerability arises because the rsyncd service grants access solely based on the client’s source IP address, making it susceptible to IP spoofing attacks that bypass authentication checks. Attackers can...

Gitroom Postiz code injection vulnerability

A security vulnerability exists in Gitroom Postiz versions 2.23.0 through 2.25.2. This vulnerability stems from the backend failing to restrict permissible functions. Logged-in users can invoke internal helper functions to read arbitrary files on the server, potentially leading to the exposure of...

Flatpak xdg-desktop-portal path traversal vulnerability

Versions of Flatpak prior to xdg-desktop-portal 1.22.1 contain a path traversal vulnerability. This vulnerability arises because the FileChooser.SaveFiles method fails to validate filenames. Malicious sandbox applications can exploit this method to gain arbitrary file access on the host system, b...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...

AIDE 0.19.5

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

Linux Distros Unpatched Vulnerability : CVE-2026-99052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc...

Linux Distros Unpatched Vulnerability : CVE-2026-115378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious...

Linux Distros Unpatched Vulnerability : CVE-2025-60476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service Do...

Linux Distros Unpatched Vulnerability : CVE-2025-60489

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of...

Linux Distros Unpatched Vulnerability : CVE-2025-60478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service D...

Linux Distros Unpatched Vulnerability : CVE-2025-71438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via...

Linux Distros Unpatched Vulnerability : CVE-2026-114140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4.0 until 7.17.2, ExtractOutputPreprocess...

Linux Distros Unpatched Vulnerability : CVE-2025-60479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servic...

Linux Distros Unpatched Vulnerability : CVE-2025-55654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying...