SUSE CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

SUSE CVE-2026-73624

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen fil...

EUVD-2026-63758

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

PT-2026-79358

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Authenticated administrators can perform path traversal by using directory traversal sequences in the Bazaar install and uninstall endpoints. By providing crafted values for the packageName parameter,...

CVE-2026-48755: Improper Input Validation

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

SUSE SLED15 / SLES15 Security Update : open-iscsi (SUSE-SU-2026:3647-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3647-1 advisory. - CVE-2026-44943: remote file-write as root via discovery bsc1268353. - CVE-2026-44944: iscsiuio control-socke...

CVE-2026-55168: Improper Link Resolution Before File Access

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-48752: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

PT-2026-79455

Name of the Vulnerable Software and Affected Versions Runtipi versions prior to 4.10.1 Description Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can create a symlink a...

CVE-2026-48769: Improper Input Validation

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches th...

PT-2026-79287

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

PT-2026-79360

Name of the Vulnerable Software and Affected Versions JuiceFS affected versions not specified Description The filestore backend in pkg/object/file.go, used for file:// stores and as a common sync destination, fails to verify if the target path remains within the root directory. The pathkey functi...

CVE-2026-76158: External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-77113

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113

The apport-unpack utility in Canonical Apport (versions before 2.36.0, 2.34.2, and 2.28.4) is vulnerable to path traversal: attacker-controlled key names in crash report files allow creation or overwriting of arbitrary files with the privileges of the executing user. CVSS 6.7 (MEDIUM), local vect...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-17171 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links...

CVE-2026-17171

CVE-2026-17171 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is improper resolution of symbolic links , which allows a local attacker with low privileges to overwrite arbitrary files , resulting in high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIG...