Virtualenv: Builtin Creation Follows Linked Environment Directories

Summary The builtin creator accepts existing directory symlinks through ensuredir and writes environment files through those directories. This permits writes outside the requested destination. Anthropic's OSS Scanner reported this as "ANT-2026-MUFJEG11" in "virtualenv-20261015-005", received on 1...

EUVD-2026-108073

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-96293 Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file lef...

CVE-2026-96293

WatchGuard Endpoint Security 's Full Disk Encryption feature for macOS contains a cleartext storage vulnerability. The issue arises because the software persistently writes a diagnostic log file that is globally readable by all local users. This allows a local, unprivileged user or process to obt...

CVE-2026-112311 WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112311 WordPress ACF Extended plugin <= 0.9.2.7 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112311

The ACF Extended WordPress plugin (versions

cyberpanel-poc

CyberPanel v2.4 — Authenticated Privilege Escalation Chain...

CVE-2026-98684

A flaw was found in the Linux kernel's Server Message Block SMB client. When performing file space allocation operations against certain remote servers, such as Windows servers, the client queries allocated file ranges before flushing recently written data. Because the remote server may report...

CVE-2026-98682

A flaw was found in the Linux kernel's Server Message Block SMB client subsystem. Due to improper synchronization during server-side file copy and clone operations, pending write operations are not drained before copying begins. A local user could exploit this timing issue during copy operations ...

CVE-2026-98681

A flaw was found in the Linux kernel's SMB Server Message Block client. Multiple internal file status flags shared the same memory byte without unified locking, creating a race condition during concurrent file operations. A local user performing simultaneous file operations could cause updates to...

CVE-2026-16648

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7...

Pulse Connect Secure SSL VPN Arbitrary File Read

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. id: CVE-2019-11510 info: name: Pulse...

EUVD-2026-107871

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7...

CVE-2026-87955

Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1...

DEBIAN-CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...

CVE-2026-114714

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause fil...