CentOS Linux 8.4 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1788956505)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1788956505 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module...

CentOS Linux 8 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1783340758)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1783340758 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

CentOS Linux 7 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1783690752)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1783690752 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when loadin...

CVE-2026-103591: External Control of File Name or Path

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/file endpoint via the repourl parameter. Attackers can supply a non-URL repourl value to bypass path containment checks and read any file accessible to the API process by...

VulnCheck KEV: CVE-2024-58387

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

VulnCheck KEV: CVE-2023-54402

iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that allows remote unauthenticated attackers to fetch arbitrary URLs by supplying a hardcoded default token value testtoken to bypass authentication. Attackers can exploit the unrestricted URL scheme handlin...

VulnCheck KEV: CVE-2023-54403

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

CVE-2026-75098: Improper Limitation of a Pathname to a Restricted Directory

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

PT-2026-105501

Summary StaticFileHandler allows an unauthenticated attacker to read arbitrary files from the server's filesystem by requesting a path that resolves to a symbolic link placed inside the static root directory. Any application that serves user-uploadable content, or whose static directory is...

CVE-2026-102457: Improper Limitation of a Pathname to a Restricted Directory

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files...

AlmaLinux 9.2 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1783341999)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783341999 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

AlmaLinux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

Rocky Linux 9.6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783345900)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783345900 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

PT-2026-103070

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user...

PT-2026-103292

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

PT-2026-103462

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws- Fly Machine exposes endpoints /health, /file/, /archive/ without any authentication or origin check. Any ho...

AlmaLinux 9.6 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-static / glib2-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1783345900)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783345900 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

AlmaLinux 9.6 [TuxCare] Security Update: perl-Archive-Tar (ALMALINUX9.6:CLSA-2026:1783078783)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783078783 advisory. - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

PT-2026-103079

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...

Telerik UI for ASP.NET AJAX 2009.1.311 < 2026.2.708 RadChart ChartImage.axd File Read

The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2009.1.311 or later and prior to 2026.2.708. It is, therefore, affected by an information disclosure vulnerability. The obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated...