DEBIAN-CVE-2026-19880

Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value e.g. via an HTTP...

CVE-2026-73620

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2026-72819 Grav CMS before 2.0.13 Remote Code Execution via ZIP Upload

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

GO-2026-5450 vulnerabilities

Vulnerabilities for packages: virt-controller-fips, virt-operator, virt-operator-fips, virt-launcher, virt-handler, virt-handler-fips, virt-api-fips, virt-api, docker-machine-driver-harvester, virt-controller...

GO-2026-4512 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, nuclei...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2023-2069 vulnerabilities

Vulnerabilities for packages: croc...

GO-2023-2072 vulnerabilities

Vulnerabilities for packages: croc...

GO-2023-2071 vulnerabilities

Vulnerabilities for packages: croc...

GO-2023-2068 vulnerabilities

Vulnerabilities for packages: croc...

GO-2025-3838 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2024-2482 vulnerabilities

Vulnerabilities for packages: goreleaser...

GO-2026-5322 vulnerabilities

Vulnerabilities for packages: grafana...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-4405 vulnerabilities

Vulnerabilities for packages: dagdotdev...

GO-2026-4406 vulnerabilities

Vulnerabilities for packages: dagdotdev...

JLSEC-2026-1319 sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when ...

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server...

EUVD-2026-58501

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...