RLSA-2026:72424 Important: resteasy security update

RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified and portable implementation of the JAX-RS specification. Security Fixes: resteasy-core: RESTeasy SourceProvider remote unauthenticated file read...

PT-2026-102749

An unauthenticated attacker can make get page template page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE...

PT-2026-102958

Name of the Vulnerable Software and Affected Versions wgagent affected versions not specified Description A missing authorization issue in the session initialization function of the wgagent management daemon allows an authenticated user with low privileges, such as a guest or read-only...

PT-2026-102768

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A heap-buffer-overflow occurs when a TFTP server responds with a short ERROR packet. The client only verifies that the datagram is at least four bytes long, but...

RHEL 9 : resteasy (RHSA-2026:72424)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:72424 advisory. RESTEasy contains a JBoss project that provides frameworks to help build RESTful Web Services and RESTful Java applications. It is a fully certified...

Oracle Linux 9 : resteasy (ELSA-2026-72424)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-72424 advisory. 3.0.26-20 - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read Resolves: RHEL-251553 Tenable has extracted the preceding description block...

MiracleLinux 9 : resteasy-3.0.26-20.el9_8 (AXSA:2026-1935:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1935:01 advisory. resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-17615 Tenable has extracted the preceding description block directly from th...

RockyLinux 9 : resteasy (RLSA-2026:72424)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:72424 advisory. resteasy-core: RESTeasy SourceProvider remote unauthenticated file read CVE-2026-17615 Tenable has extracted the preceding description block directly from the...

Amazon Linux 2 : resteasy-base (ALAS-2026-3936)

The version of resteasy-base installed on the remote host is prior to 3.0.6-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3936 advisory. A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an...

PT-2026-109074

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe join function used by send from directory can allow a NUL: special-device path because safe join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application ru...

SUSE CVE-2026-93537

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

UBUNTU-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386 ZoneMinder 1.37.x Path Traversal via files view

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 are vulnerable to a path traversal vulnerability within the files view. The root cause is the improper validation of the path parameter before it is passed to the output_file function. This allows authenticated users with Events view permission to read arb...

CVE-2026-55156

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

EUVD-2026-88398

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

CVE-2026-55156 Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication...

CVE-2026-55156

The token-optimizer-mcp dashboard HTTP server is vulnerable to an unauthenticated path traversal (CWE-22) in the /api/session-summary and /api/session-events endpoints. The root cause is the lack of authentication middleware and the direct concatenation of the user-supplied sessionId query parame...