Linux Distros Unpatched Vulnerability : CVE-2026-114094

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can craft a...

Linux Distros Unpatched Vulnerability : CVE-2025-55640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a...

IBM App Connect Enterprise 12.0.1.x < 12.0.12.30 / 13.0.1.x <= 13.0.8.2 Arbitrary File Write (7293001)

The version of IBM App Connect Enterprise installed on the remote host is 12.0.1.x prior to 12.0.12.30, or 13.0.1.x prior or equal to 13.0.8.2. It is, therefore, affected by an arbitrary file write vulnerability. IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file...

PT-2026-122101

baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, the optional BcThemeFile plugin's Admin API validates a raw path in ThemeFilesService::update and getFullpath, but ThemeFileForm:: execute subsequently applies rawurldecode to fullpath before...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.9. It stems from xfs’s improper handling of the reflink flag during swap mapping, causing subsequent writes to shared blocks not to be performed via copy-on-write. This may result in corruption of other files sharing those blocks...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

Gitroom Postiz code injection vulnerability

A security vulnerability exists in Gitroom Postiz versions 2.23.0 through 2.25.2. This vulnerability stems from the backend failing to restrict permissible functions. Logged-in users can invoke internal helper functions to read arbitrary files on the server, potentially leading to the exposure of...

Zimbra Collaboration Suite authorization issue vulnerability

Zimbra Collaboration Suite versions 10.1.20 and earlier contain an authorization issue vulnerability. This vulnerability arises because FileSharedWithMeRequest requests bypass the authorization check for delegated accounts. Without proper validation of document sharing, the system accepts file...

Flatpak xdg-desktop-portal path traversal vulnerability

Versions of Flatpak prior to xdg-desktop-portal 1.22.1 contain a path traversal vulnerability. This vulnerability arises because the FileChooser.SaveFiles method fails to validate filenames. Malicious sandbox applications can exploit this method to gain arbitrary file access on the host system, b...

CGM CLININET authorization issue vulnerability

CGM CLININET versions 2026.MS3 and earlier contain an authorization issue vulnerability. This vulnerability arises because the rsyncd service grants access solely based on the client’s source IP address, making it susceptible to IP spoofing attacks that bypass authentication checks. Attackers can...

PT-2026-121804

The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted based solely on the client's source IP address. An attacker able to spoof an allowed IP address, can bypass this check and gain the ability to edit files on the affected system. The...

Node.js Node permissions and access control issues vulnerability

Node.js versions 26.12.0 and earlier contain a permission and access control vulnerability. This issue stems from improper enforcement of the permission model on the file system: when a request path is shorter than the wildcard authorization prefix, the base tree search stops comparing early and...

PT-2026-122143

Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes several XML parsing helpers that construct a JAXP parser with the default, non-secure configuration. The...

PT-2026-122108

A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite ZCS allows an authenticated user to consume another user’s mailbox quota by repeatedly sharing and revoking a document. Creation of the recipient’s shared-file record charges the document size to mailbox-wide usage. Revocation...

AIDE 0.19.5

AIDE Advanced Intrusion Detection Environment is a free replacement for Tripwiretm. It generates a database that can be used to check the integrity of files on server. It uses regular expressions for determining which files get added to the database. You can use several message digest algorithms ...

Linux Distros Unpatched Vulnerability : CVE-2026-99052

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc...

Linux Distros Unpatched Vulnerability : CVE-2025-60480

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow in the gfodfac4cfgalternativeinfo function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers t...

Linux Distros Unpatched Vulnerability : CVE-2026-115378

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability in sftpRecursivePullFile that allows a malicious...

Linux Distros Unpatched Vulnerability : CVE-2025-60478

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpacketdestroy function /filtercore/filterpck.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service D...

Linux Distros Unpatched Vulnerability : CVE-2025-60476

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap use-after-free in the gfodfac4cfgcleanlist function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service Do...