CVE-2026-96454 Pake grants unrestricted IPC access to every HTTPS origin loaded in generated applications

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

CVE-2026-91797

Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened...

DEBIAN-CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331 Apache BuildStream: tar source extraction escape

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331 Apache BuildStream: tar source extraction escape

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

The Apache BuildStream tar source plugin contains an improper link resolution (link following) vulnerability when running on Python = 3.12 with BuildStream >= 2.3.0 due to the use of the Python tarfile filter functionality. Users are recommended to upgrade to version 2.8.1 to resolve the issue...

CVE-2026-75799

The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...

CVE-2026-96656: External Control of File Name or Path

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

CVE-2026-82331: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-96276

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

PT-2026-97264

Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with...

PT-2026-97216

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description Foxit PDF Editor/Reader fails to validate the directory traversal path in the attachment file name. This allows malicious attachments to be written to directories outside the...

PT-2026-105043

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No safe relative path / traversal check is applied ...

PT-2026-105970

Summary uncbv extract writes each archive entry to output dir.joinentry filename using the filename stored in the archive with no check for .. components or absolute paths. A malicious .cbv / .cbz archive whose entry name contains ../ or an absolute path can therefore cause files to be written...

SUSE SLES12 Security Update : amazon-ssm-agent (SUSE-SU-2026:4286-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4286-1 advisory. - CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 - CVE-2026-56855:...

PT-2026-97565

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An issue exists in the trace consumer where the output path is...

CVE-2026-67224: Improper Limitation of a Pathname to a Restricted Directory

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No saferelativepath / traversal check is applied on...

CVE-2026-96275: Improper Limitation of a Pathname to a Restricted Directory

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

AlmaLinux 10 : podman (ALSA-2026:70201)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:70201 advisory. podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 podman: Go net/http: Unencrypted HTTP/2...