PT-2026-76653

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.6 In Progress ShareFile Storage Zones Controller versions prior to 6.0.3 Description An authenticated zone administrator can exploit improper validation within the download...

CVE-2026-19693: Improper Link Resolution Before File Access

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-12553: Out-of-bounds Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

PT-2026-82817

Name of the Vulnerable Software and Affected Versions Suricata-Update affected versions not specified Description Suricata-Update fails to properly validate destination paths during the extraction of files from downloaded rule archives. This flaw allows an attacker to write arbitrary files outsid...

PT-2026-76655

Name of the Vulnerable Software and Affected Versions extract-zip versions prior to 2.0.2 Description Containment checks only verify the parent directory of each archive entry and ignore the entry's own final path component. This allows an archive containing two entries with identical names—a...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-19725

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

EUVD-2026-59918

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

EUVD-2026-59792

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-74796: Improper Link Resolution Before File Access

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-74764

CVE-2026-74764 affects Pandora’s TAR extraction. The extractor passes archive member names directly to Python tarfile.TarFile.extract() without a filter, enabling path traversal via ../ or absolute paths. This could allow overwriting files in the Pandora worker directory and potentially lead to a...

CVE-2026-74764

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-74764 Path Traversal in TAR Archive Extraction Allows Arbitrary File Write in Pandora

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-64607 vulnerabilities

Vulnerabilities for packages: druid, cassandra-reaper, flyway, sonarqube, nrjmx, akhq, opensearch, thingsboard, wavefront-proxy, zipkin, cloudwatch-exporter, dependency-track, trino, apicurio-registry, kserve-modelmesh, logstash...

CVE-2026-74487 binfmt_misc: restore write access when removing an entry

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: restore write access when removing an entry Registering an entry with the MISCFMTOPENFILE flag opens the interpreter via openexec which denies write access to it for as long as the entry exists. Removing the entry...