Ubuntu Security Notice USN-8640-1

Ubuntu Security Notice 8640-1 - It was discovered that Engrampa incorrectly handled symbolic links when extracting certain archives. An attacker could possibly use this issue to write arbitrary files and execute arbitrary code...

CVE-2026-52610

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

VulnCheck KEV: CVE-2026-25895

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched ...

CVE-2026-52610

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

CVE-2026-52610

The software reportico-web (version

EUVD-2026-61092

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

Linux Distros Unpatched Vulnerability : CVE-2026-19693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive...

Amazon Linux 2 : spice-vdagent, --advisory ALAS2-2026-3863 (ALAS-2026-3863)

The version of spice-vdagent installed on the remote host is prior to 0.14.0-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3863 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write...

CVE-2026-63328: Improper Limitation of a Pathname to a Restricted Directory

Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under /.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

PT-2026-77164

Name of the Vulnerable Software and Affected Versions CodeWhale versions 0.8.41 through 0.8.63 Description An argument injection issue exists in the git show tool. The rev parameter is passed unvalidated into the git show argument vector without an --end-of-options sentinel, allowing a value...

CVE-2026-75855: Improper Limitation of a Pathname to a Restricted Directory

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete arbitrary files outside the configured database directory. Attackers can supply database names...

PT-2026-78237

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description The perform-scheduled-backup IPC handler in src/ipc/storage.js fails to verify if the settings.path provided by a renderer-supplied object is within an authorized backup location. This allows a...

GitPython Diffable.diff File Write

The vulnerability of the Diffable.diff method in the Python library for interacting with git repositories in GitPython relates to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to re-write any files in the system remotely...

Amazon Linux 2023 : spice-vdagent (ALAS2023-2026-2061)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2061 advisory. A flaw was found in spice-vdagent. A malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This vulnerability can lead to a heap buffer...

CVE-2026-52875: Improper Limitation of a Pathname to a Restricted Directory

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

flyto-core 2.26.7 - Arbitrary File Write

Exploit Title: flyto-core 2.26.7 - Arbitrary File Write Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/flytohub/flyto-core Software Link: https://github.com/flytohub/flyto-core Version: flyto-core = 2.26.7 fixed 2.26.8; incomplete fix of GHSA-29...

CVE-2026-52610

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

PT-2026-76952

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description Authenticated root users can perform path traversal—a technique used to access files and directories outside the intended folder—by providing database names containing ../ sequences. This occurs...

PT-2026-77234

Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description An arbitrary file write and directory traversal issue exists where remote attackers can create or overwrite files on the filesystem based on the web user permissions. This occurs at the 'run.ph...