Linux Distros Unpatched Vulnerability : CVE-2026-73585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink...

PT-2026-71625

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Authenticated clients can bypass module-level filter restrictions by providing malicious --filter merge file directives. During filter evaluation, attackers can inject client-side merge file directives...

PT-2026-71633

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the --temp-dir or --link-dest options, whi...

PT-2026-71638

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the --remove-source-files feature. This occurs when an attacker with symlink creation access atomically substitutes a symlink for a source file between the completion...

PT-2026-71624

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path traversal issue exists when using --relative mode. A malicious sender can write files outside the intended destination directory tree by crafting relative paths containing symlink components. Th...

PT-2026-71717

Name of the Vulnerable Software and Affected Versions Podman version 5.8.x Description The podman quadlet install --replace command fails to truncate existing destination files when opening them with O CREATE|O WRONLY without O TRUNC. On filesystems that do not support reflinks, such as many...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

PT-2026-71904

Name of the Vulnerable Software and Affected Versions luci-app-openvpn affected versions not specified Description Authenticated users can perform path traversal and write arbitrary files outside the intended directory because the software fails to properly validate the instance name2 parameter...

podman -- podman quadlet install --replace does not fully replace the old file

The Podman developers report: When running podman quadlet install --replace to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved...

PT-2026-71460

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during scri...

Linux Distros Unpatched Vulnerability : CVE-2026-19730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt...

SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:3589-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3589-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package UR...

PT-2026-71635

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the sender's source tree traversal. An attacker capable of manipulating a parent directory of the source tree can redirect file reads to unintended paths. This is...

PT-2026-71402

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.6.0 through 4.6.7 Description A heap-based buffer overflow occurs in the TTX Logger file parser, which can lead to a crash and result in a denial of service. Recommendations Update Wireshark to a version later than 4.6.7...

PT-2026-71403

Name of the Vulnerable Software and Affected Versions Gammu versions 4.6.0 through 4.6.7 Description A crash in the DCT3 trace file parser allows for a denial of service. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2026-71640

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a...

PT-2026-71903

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

PT-2026-71827

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

PT-2026-71516

Subscriber Path Traversal in Do Lasso = 358 versions...

PT-2026-71907

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing...