109065 matches found
CVE-2026-84645
A flaw was found in Jenkins. This vulnerability allows a remote attacker to achieve remote code execution. By manipulating user-submitted configuration files, an attacker can exploit a deserialization weakness where specially crafted objects can process HTTP requests. This grants unauthorized...
CVE-2026-88808: Execution with Unnecessary Privileges
A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same...
PT-2026-99889
Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.2 through 4.0.13 Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.21.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.x Description A path traversal issue exists in the btrfs storage drive...
PT-2026-99870
Name of the Vulnerable Software and Affected Versions dbgate versions 6.x through 6.8.1 dbgate versions 7.0.x through 7.0.2 dbgate versions 7.1.x through 7.1.8 dbgate versions 7.2.x through 7.2.5 dbgate versions 7.3.x through 7.3.1 Description A path traversal issue exists in the save-uploaded-fi...
PT-2026-99877
Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal issue exists in the Export Handler component within the exportModelSql function of the packages/api/src/controllers/databaseConnections.js file. A remote attacker can manipulate the...
CVE-2026-102335: Incorrect Authorization
Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...
CVE-2026-81375: Externally Controlled Reference to a Resource in Another Sphere
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted attachment file path. This vulnerability w...
PT-2026-99850
Name of the Vulnerable Software and Affected Versions Google Cloud Application Integration versions prior to 2026-06-30 Description A Confused Deputy issue in the EmailTask component on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files...
PT-2026-102386
Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.37.0 through 1.37.x Description Authenticated users with Events view permission can read arbitrary files due to improper validation of the path parameter before it is passed to the output file function. This path traversa...
CVE-2026-19444: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary ...
PT-2026-99921
Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10 Description An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admi...
PT-2026-99881
A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...
CVE-2026-101070: Improper Limitation of a Pathname to a Restricted Directory
A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...
CVE-2024-58386: Improper Limitation of a Pathname to a Restricted Directory
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...
PT-2026-102381
Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description Flatpak fails to validate vendor-extension keys against an allowlist when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, passing them through unmodified. ...
CVE-2026-96284
A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control...
CVE-2026-96279
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...
UBUNTU-CVE-2026-96279
A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...
