PT-2026-98218

Name of the Vulnerable Software and Affected Versions http4s-scala-xml versions prior to 0.24.1 http4s-scala-xml versions prior to 1.0.0-M39 Description EntityDecoderF, scala.xml.Elem instances used to parse XML message bodies utilize a javax.xml.parsers.SAXParserFactory without security...

PT-2026-98201

Name of the Vulnerable Software and Affected Versions ZITADEL versions 3.0.0 through 3.4.12 ZITADEL versions 4.0.0 through 4.16.0 Description ZITADEL Actions V1 allows an organization Action author with ORG OWNER, org.action.write, and org.flow.write permissions to read files from the host...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

DEBIAN-CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-92164

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

CVE-2026-79306: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

PT-2026-97599

Name of the Vulnerable Software and Affected Versions OpenShift console affected versions not specified Description An unauthenticated attacker can exploit a path traversal flaw by manipulating the lng and ns query parameters in the '/locales/resource.json' endpoint. This allows the attacker to...

PT-2026-97343

Name of the Vulnerable Software and Affected Versions Streamlink versions prior to 8.6.0 Description Streamlink is a CLI utility that pipes video streams from various services into a video player. The HTTPSession component mounts a FileAdapter for the file scheme and inherits redirect handling fr...

Linux Distros Unpatched Vulnerability : CVE-2026-94108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disable entity loading on...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-92700: Improper Handling of Case Sensitivity

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

PT-2026-97369

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scop...

GHSA-MRQ8-FV7V-HHJG MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...

MCP Atlassian: HTTP upload tools accept arbitrary server-local file paths

sooperset/mcp-atlassian: HTTP upload tools can attach arbitrary server-local files Date: 2026-05-05 Target: sooperset/mcp-atlassian Commit: d8bc78698a63cb6b321c7ca796d6329d448f7f6d Summary mcp-atlassian supports HTTP/SSE deployment for persistent, remote, and multi-user use. In that mode,...

CVE-2026-77253

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...