CVE-2026-87690 Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...

EUVD-2026-97177

The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...

Exploit for UNIX Symbolic Link Following in Postgresql

abraxaslabs.tech · github.com/abraxas ·&...

PT-2026-110468

Name of the Vulnerable Software and Affected Versions Metasploit Framework affected versions not specified Description The post module post/apple ios/gather/ios image gather contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be...

Amazon Linux 2 : rsyslog (ALAS-2026-3967)

The version of rsyslog installed on the remote host is prior to 8.24.0-57. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3967 advisory. rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid...

EulerOS 2.0 SP13 : perl-Archive-Tar (EulerOS-SA-2026-4082)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

CVE-2026-87690: Improper Limitation of a Pathname to a Restricted Directory

The Metasploit Framework post module post/appleios/gather/iosimagegather is affected by a relative path traversal vulnerability CWE-22. The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the loc...

CVE-2026-109375: Improper Link Resolution Before File Access

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbol...

PT-2026-111094

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing "dot dot" sequences /../, an attacker can write arbitrary files ...

PT-2026-110953

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.3 Description An authenticated user can manipulate the backup process by creating or modifying an automatic backup. The AutoBackup.GetName function returns a user-controlled name that does not reject path...

PT-2026-110924

🚨 CVE-2026-109375 Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent...

Important: rsyslog

Issue Overview: rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a valu...

Important: rsyslog

Issue Overview: rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a valu...

EulerOS 2.0 SP13 : docker-engine (EulerOS-SA-2026-4132)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine...

EulerOS 2.0 SP13 : perl-Archive-Tar (EulerOS-SA-2026-4173)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

CVE-2026-108839 thClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs

thClaws through 0.141.0 contains a link-following vulnerability in the postinputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the workspace by following symlinks. Attackers who plant a symlink under the allowed inputs/ prefix can cause later authenticated uploads to...

CVE-2026-108839

The software thClaws (versions through 0.141.0 ) is vulnerable to a link-following vulnerability (CWE-59) within the post_inputs handler of the v1 API POST /v1/inputs endpoint. An attacker can plant a symlink under the permitted inputs/ prefix, which allows subsequent authenticated uploads to wri...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

The Cohere Python SDK versions 5.11.0 through 7.2.0 are vulnerable to a path traversal (tar slip) vulnerability within the _s3_models_dir_to_tarfile function. The root cause is the use of unvalidated tarfile.extractall() calls, which allows an attacker who can write model archives to the victim's...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...