PT-2026-65614

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.62.0 Description An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema $ref targets. The application fails to restrict these targets to the...

Linux Distros Unpatched Vulnerability : CVE-2026-45623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prio...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

DEBIAN-CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

CVE-2026-45623

PostCSS vulnerability CVE-2026-45623 affects versions up to 8.5.11. The PreviousMap parses the /*# sourceMappingURL=PATH */ comment from CSS, dereferencing PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker-controlled CSS input can cause the host process...

CVE-2026-45623 PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the / sourceMappingURL=PATH / comment from any CSS string passed to process and dereferences PATH against the...

OPENSUSE-SU-2026:21448-1 Security update for agama-web-ui

This update for agama-web-ui fixes the following issues: - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. - CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames bsc1272310....

SUSE-SU-2026:3283-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...

CVE-2026-65920

A flaw was found in Diffusers. This path traversal vulnerability in the getcheckpointshardfiles function allows a remote attacker to read arbitrary files. By supplying malicious weightmap values in model index JSON, an attacker can use ../ sequences or absolute paths to escape the model directory...

CVE-2025-15662 Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

CVE-2025-15662

The CVE-2025-15662 issue affects the Printcart Web to Print Product Designer for WooCommerce WordPress plugin up to version 2.5.3. The root cause is that the plugin does not restrict a user-supplied URL before server-side fetching and does not enforce a valid authorization check, enabling unauthe...

CVE-2025-15662

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

Linux Distros Unpatched Vulnerability : CVE-2026-65698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host file...

PT-2026-71447

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.57 Description An incomplete denylist in the unsafe git archive options guard allows attackers to provide the --add-file and --add-virtual-file options to the Repo.archive function. This can be exploited to read...

PT-2026-71448

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.57 Description Insufficient guarding of git option forwarding in the IndexFile.checkout and TagReference.create functions allows attackers to pass unsafe options via kwargs. This can be exploited using the...

CVE-2026-14955 Checkout Field Editor for WooCommerce (Pro) <= 3.7.7 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'thwcfe_legacy_file' Parameter

The Checkout Field Editor for WooCommerce Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfelegacyfile' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the content...

GHSA-86CX-WWF4-PHQ4 OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation API

Summary An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user...