Kavita path traversal vulnerability

Versions Kavita 0.5.2 through 0.5.4.1 contain a path traversal vulnerability. This vulnerability arises because the filename parameter allows path traversal; unauthenticated attackers can send GET requests containing ../ sequences to /api/image/cover-upload to read any file outside the temporary...

PT-2026-121348

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory...

CVE-2017-20289: Improper Control of Filename for Include/Require Statement in PHP Program

Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...

Linux Distros Unpatched Vulnerability : CVE-2026-115207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow t...

SUSE SLED15: ImageMagick / ImageMagick-config-7-SUSE / etc (SUSE-SU-2026:4799-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4799-1 advisory. - CVE-2026-93586: use-after-free in the ImagesToBlob method can lead to a process crash bsc1281912. -...

Linux Distros Unpatched Vulnerability : CVE-2026-92205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on...

Fedora 43 : gnome-shell-extension-gsconnect (2026-eb93fa8f63)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-eb93fa8f63 advisory. Voici les notes de la release, telles que publies par daniellandau le 2026-09-23 : --- Release GSConnect v73 What's Changed Security: fix authenticated path...

RHEL 10 : buildah (RHSA-2026:88262)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:88262 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

AlmaLinux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792704664)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792704664 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

PT-2026-121431

Name of the Vulnerable Software and Affected Versions fpdf2 versions prior to 2.8.8 Description The shared image loader in this PDF creation library automatically dereferences attacker-controlled HTTPS URLs and raw local paths. This occurs when input is supplied through the FPDF.image function,...

PT-2026-125066

Applications that pass attacker-controlled URLs to webpage versions before 2.1.0 may be vulnerable to server-side request forgery SSRF or local file disclosure. HTTP::fetch and Webpage::from url passed URLs to libcurl without restricting the URL scheme or validating the resolved destination IP...

ALSA-2026:88262 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

Rocky Linux 10.2 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_86056)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202686056 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via...

Rocky Linux 9.6 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792704664)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792704664 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (crlsa-2026_85239)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202685239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification bypa...

SUSE SLED15 / SLES15 Security Update : openexr (SUSE-SU-2026:4828-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4828-1 advisory. This update for openexr fixes the following issue: - CVE-2026-88384: NULL pointer dereference in the C++ attribute...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-good Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792533291)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792533291 advisory. - GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

SUSE SLED15 / SLES15 Security Update : cifs-utils (SUSE-SU-2026:4819-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4819-1 advisory. This update for cifs-utils fixes the following issue: - CVE-2026-104715: mount options injection via CIFS...

Linux Distros Unpatched Vulnerability : CVE-2026-85518

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in OpenSCAP. When decomposing a Source DataStream SDS file, the application does not properly validate relative file path attributes, leading t...

Unity Linux 20.1020e / 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-142754)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142754 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2IOCMOVEEXT operations, userspa...