CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...

CVE-2026-61800 Wazuh cluster worker file sync allows arbitrary file write under /var/ossec (incomplete fix for CVE-2026-30893)

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.4.0 through 4.14.6, a party holding the cluster key can write, overwrite, or delete arbitrary files under /var/ossec on worker nodes, leading to remote code executi...

[SECURITY] Fedora 43 Update: nextcloud-34.0.3-1.fc43

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)

Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)

Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)

Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)

Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...

GO-2023-2328 vulnerabilities

Vulnerabilities for packages: rclone...

CVE-2026-19372

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19372 Handwriting-OCR handwriting-ocr-mcp-server upload_document index.ts fs.readFileSync path traversal

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

PT-2026-56305

Name of the Vulnerable Software and Affected Versions goploy version 1.17.5 Description An Insecure Direct Object Reference IDOR exists in the project and project-file handlers. The application fails to verify if a project or project-file belongs to the caller's namespace when processing requests...

PT-2026-51530

Name of the Vulnerable Software and Affected Versions NanoClaw versions prior to 2.1.17 Description An issue exists in the forwardAttachedFiles function where the host validates attachment filenames using only isSafeAttachmentName before performing a copy operation with fs.copyFileSync. Because...

Azure File Sync Agent v22.4 Release – June 2026 (KB5104852)

Azure File Sync Agent v22.4 Release – June 2026 KB5104852...

Azure File Sync Agent v22.4 Release – June 2026 (KB5104852)

Azure File Sync Agent v22.4 Release – June 2026 KB5104852...

Azure File Sync Agent v22.4 Release – June 2026 (KB5104852)

Azure File Sync Agent v22.4 Release – June 2026 KB5104852...

Azure File Sync Agent v22.4 Release – June 2026 (KB5104852)

Azure File Sync Agent v22.4 Release – June 2026 KB5104852...

Mattermost Server 10.11.x < 10.11.16 / 11.5.x < 11.5.5 / 11.6.x < 11.6.2 Multiple Vulnerabilities (MMSA-2026-00616 / MMSA-2026-00649 / MMSA-2026-00655 / MMSA-2026-00656 / MMSA-2026-00661 / MMSA-2026-00662 / MMSA-2026-00665)

The version of Mattermost Server installed on the remote host is affected by multiple vulnerabilities: - Mattermost fails to require role-management authorization when setting the schemeadmin flag on group syncable link and patch endpoints, which allows a user with group-link permissions to...

Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 fail to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations within the targ...

CVE-2026-6961: Improper Limitation of a Pathname to a Restricted Directory

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15, 10.11.x = 10.11.16 Mattermost fails to sanitize FileInfo.Name received from federated peers during shared channel file sync, which allows an attacker who controls a federated server to write files to arbitrary locations...

CVE-2026-40987 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...