CVE-2026-111935: External Control of File Name or Path

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attackers to read local image files via unvalidated synced sourceUrl paths. Attackers with write access to the victim's sync target can plant absolute paths or file:// URLs, causing...

ALSA-2026:84595 Moderate: cockpit-files security update

A filesystem browser for Cockpit Security Fixes: cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste CVE-2026-91202 cockpit-files: cockpit-files: Local attacker can hijack file ownership via symlink race CVE-2026-91205 For more details about the...

CVE-2026-85250: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-91858: Improper Restriction of XML External Entity Reference

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-111925: Improper Limitation of a Pathname to a Restricted Directory

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/mediadirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...

PT-2026-117396

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media dirs because FileLibraryProvider.lookup lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with...

Amasty Order Attributes 3.16.0 Arbitrary File Upload

Amasty Order Attributes versions through version 3.16.0 contain an unauthenticated arbitrary file upload vulnerability. This proof of concept uploads supplied HTML content or, in full mode, PHP web shells. https://packetstorm.news/download/236358...

PT-2026-117458

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

PT-2026-117331

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.0 Description A path traversal issue exists in the Apache Camel FTP component affecting ftp, ftps, and sftp schemes. The remote-file consumers build absolute...

PT-2026-117426

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi access point that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num ep fine set to zero and an...

PT-2026-117398

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate remote url in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

PT-2026-117402

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit h...

RHEL 9 : gegl04 (RHSA-2026:84575)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:84575 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

RHEL 9 : gegl04 (RHSA-2026:85253)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:85253 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: gegl: GIMP: Remote code execution via integer...

Exploit for CVE-2026-53787

CVE-2026-53787 Amasty Order Attribute AOA file upload exploit,...

DEBIAN-CVE-2026-98553

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

DEBIAN-CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

CVE-2026-98777

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

AZL-109454 CVE-2026-98778 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

AZL-108683 CVE-2026-98777 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...