PT-2026-78786

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A user with the Administrator role can perform path traversal during the archive extraction process of the Universal Forwarder installer. This occurs because the credentials-package extraction...

PT-2026-78837

Name of the Vulnerable Software and Affected Versions Agno affected versions not specified Description PythonTools in libs/agno/agno/tools/python.py contains a path traversal issue. This occurs when parent-directory traversal sequences are supplied in the file name argument passed to the read fil...

PT-2026-78442

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command save-waterfall-snapshot allows an attacker to control the snapshotName input. This input is processed by backend/handlers/entities/sdr.py and passed to...

PT-2026-80641

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop secure popen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...

CVE-2026-76369: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, a user who holds the OnPrem Broker role could write files outside the intended Automation Broker log directory. The vulnerability is possible because Automation Broker log uploads accept crafted filename input before writing log files. For more information see...

CVE-2026-44829: Improper Limitation of a Pathname to a Restricted Directory

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives...

CVE-2026-18051: Improper Limitation of a Pathname to a Restricted Directory

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target...

PT-2026-83511

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

PT-2026-80730

Summary A server-side template injection SSTI vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a...

CentOS 9 : python3.9-3.9.25-10.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python3.9-3.9.25-10.el9 build changelog. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

Linux Distros Unpatched Vulnerability : CVE-2026-17106

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to...

PT-2026-79851

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-76359: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

openssl_encrypt File Read Write

The vulnerability in the opensslencrypt/modules/pluginsystem/pluginsandbox.py file, belonging to the opensslencrypt library written in Python, relates to a data protection mechanism flaw. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to rea...

Content Credentials SDK Path Traversal

The vulnerability of the Content Credentials SDK libraries is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a attacker to write arbitrary files...

PT-2026-78291

Name of the Vulnerable Software and Affected Versions W3 Total Cache WordPress plugin versions prior to 2.10.5 Description The plugin fails to properly validate the request path used to generate cache file names. This allows unauthenticated attackers to write files to any existing directory on th...

PT-2026-78721

Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary 26.0.4, the first-party production media adapters pass attacker-controlled object keys to storage SDK upload and delete operations without...

PT-2026-78785

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A path traversal issue exists in the archive extraction routine during app installation. This occurs because the system fails to validate that extracted file paths remain within the intended...

CVE-2026-52875

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-52872

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...