PT-2026-120668

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save folder/delete folder/delete file/file rename/save files of the file admin class.php of the component Folder Management. This manipulation of the...

PT-2026-120586

Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, o...

PT-2026-120607

An out-of-bounds read in gf odf ac4 cfg dsi v1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120585

Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can spoof an image MIME type to upload script-bearing files serve...

PT-2026-120497

Name of the Vulnerable Software and Affected Versions Podman affected versions not specified Description Processing corrupt or malicious inputs in the ApplyLayer and ApplyUncompressedLayer functions within storage/pkg/archive can lead to a file descriptor leak. Unbounded repeated calls to these...

PT-2026-120473

The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact a...

PT-2026-120222

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkoutpaths=... that allows attackers to write arbitrary files by abusing raw os.open without O NOFOLLOW. Attackers can craft a repository where a worktree symlink points to .git/hooks/post-checkout, so...

PT-2026-120228

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed ZIP file, because inflateAsync in methods/inflater.js lacks a zlib stream error listener. Attackers can supply a ZIP with corrupted DEFLATE data...

PT-2026-120232

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read document, which lacks sandbox checks, or safe user path-gated tools to le...

PT-2026-122070

Name of the Vulnerable Software and Affected Versions Your Dress versions prior to 1.4.2 Description An improper control of filename for include/require statements in the PHP program allows for Local File Inclusion. This enables unauthenticated attackers to include and execute arbitrary files on...

Cisco FTD: CVE-2026-76489: Multiple Cisco Products Snort 3 Denial of Service Vulnerabilities

Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to...

CVE-2025-60479

A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MPEG-4 file...

CVE-2025-60489

A NULL pointer dereference in the dasherinserttimelineentry function /filters/dasher.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-60490

A heap use-after-free in the gffilterpidsendeventdownstream function /filtercore/filterpid.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

RHEL 10 : mrtg (RHSA-2026:87255)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:87255 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provi...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4589-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4589-1 advisory. - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. -...

Fedora 44 : gnome-shell-extension-gsconnect (2026-37da8aa1f8)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-37da8aa1f8 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

Linux Distros Unpatched Vulnerability : CVE-2026-109574

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious themes or modules to read files outside the project root through...

AlmaLinux 8 : python3 (ALSA-2026:85239)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

SUSE SLES15: GraphicsMagick / GraphicsMagick-devel / libGraphicsMagick++-Q16-12 / etc (SUSE-SU-2026:4592-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4592-1 advisory. This update for GraphicsMagick fixes the following issue: - CVE-2026-103118: uncontrolled recursion in the WPG file handler when processing crafted WPG...