PT-2026-82356

An attacker who can set the file name header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0....

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

Linux Distros Unpatched Vulnerability : CVE-2026-79223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. Chromium...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-bad-free (UTSA-2026-104837)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104837 advisory. A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of th...

Linux Distros Unpatched Vulnerability : CVE-2026-79207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a crafted file...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098667)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098667 advisory. A flaw was found in the filelockinit in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number o...

CVE-2026-36851

UnPoller v2.33.0 contains a path traversal vulnerability in its password field. In pkg/inputunifi/input.go, any value prefixed with file:// is passed to os.ReadFile() without path validation, allowing an attacker with write access to the up.conf file to specify any readable file on the system. Th...

PT-2026-82044

Name of the Vulnerable Software and Affected Versions TeamViewer Desktop Clients versions prior to 15.81.5 Description Improper neutralization of path traversal sequences allows an authenticated remote session participant to write files to unintended locations on the local file system. This occur...

EUVD-2026-66662

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...

PT-2026-82212

Name of the Vulnerable Software and Affected Versions FiftyOne affected versions not specified Description The application renders a dataset field's description as markup without proper sanitization or escaping. Specifically, the sidebar field-information component located at...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: freerdp (UTSA-2026-104829)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104829 advisory. FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

Linux Distros Unpatched Vulnerability : CVE-2026-79151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tcl (UTSA-2026-054029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054029 advisory. In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wireshark (UTSA-2026-104792)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104792 advisory. Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service Tenable has extracted the preceding description block directly from the Unity...

Ubuntu 20.04 LTS : Linux kernel (GCP) vulnerabilities (USN-8668-1)

"The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8668-1 advisory. Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations,...