SUSE SLED15 / SLES15 Security Update : apache-sshd (SUSE-SU-2026:3339-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3339-1 advisory. Update to upstream version 2.19.0. Security issues fixed: - CVE-2026-56452: remote users can use SCP to send...

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-54593

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

CVE-2026-65921 Potential path traversal leading to unauthorized file writes

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location...

SUSE CVE-2026-64213

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Add lock protection to lm90alert Sashiko reports: lm90alert executes in the smbus alert context and calls lm90updateconfreg to disable the hardware alert line, without acquiring hwmonlock. Concurrently, sysfs write...

Linux Distros Unpatched Vulnerability : CVE-2026-58624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client- side and server-side SSH. Component...

GHSA-4H8Q-HH2J-755W BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

CVE-2026-66004

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

CVE-2026-66004 BlenderMCP Path Traversal via download_polyhaven_asset API

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

CVE-2026-66004

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download_polyhaven_asset method. By injecting traversal sequences in API response include keys, an attacker can write arbitrary files (e.g., ../../.bashrc), enabling overwrite of sensitive files and potentially persis...

EUVD-2026-48604

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the downloadpolyhavenasset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

CVE-2026-7483 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

CVE-2026-7483 Local privilege escalation in ESET security applications for macOS

Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user...

PT-2026-64317

BlenderMCP before commit 30a3308 contains a path traversal vulnerability in the download polyhaven asset method that allows attackers to write arbitrary files by injecting traversal sequences in API response include keys. Attackers performing MITM attacks or prompt injection can supply malicious...

EUVD-2026-48377

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...

CVE-2026-64799 Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This cou...

PT-2026-63600

Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder...

PT-2026-64087

Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowed routes includes /v1/skills, anthropic routes, or llm api routes, could upload a crafted skill...

CVE-2026-44192

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...