Curl 7.20.0 < 8.23.0 Local File Overwrite

The version of curl installed on the remote host is 7.20.0 prior to 8.23.0. It is, therefore, affected by a file overwrite vulnerability: - When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response...

Linux Distros Unpatched Vulnerability : CVE-2026-98975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: stop exchanging reflink flags when exchanging mappings When an exchange covers both files from offset 0 to idisksize, xmicanexchangereflinkflags assumes...

Linux Distros Unpatched Vulnerability : CVE-2026-55888

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-base / gstreamer1-plugins-base-devel / etc (CENTOS7:CLSA-2026:1790603589)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1790603589 advisory. - GStreamer OGG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu...

Linux Distros Unpatched Vulnerability : CVE-2025-60487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A segmentation violation in the gfisomgetesd function /isomedia/isomread.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS v...

Ancorathemes Your Dress code injection vulnerability

Ancorathemes: Versions 1.4.1 and earlier of Your Dress contain a code injection vulnerability. This vulnerability stems from improper control over filenames in Include/Require statements within PHP, potentially leading to local file inclusion...

Fallow path traversal vulnerability

A security vulnerability exists in Fallow versions from 2.68.0 up to but not including 3.34.0. This vulnerability stems from Fallow’s improper handling of project paths for the Jest and Vitest projects. Attackers can exploit this by using absolute paths, parent directory fragments, dot-prefixed...

Mervin Praison PraisonAI permission and access control issue vulnerability

Versions 4.5.110 through 4.6.61 of Mervin Praison PraisonAI contain a security vulnerability. This vulnerability arises because SandlockSandbox fails to shut down upon encountering Landlock; instead, it reverts to SubprocessSandbox. As a result, file systems and network boundaries are not enforce...

PT-2026-122244

Name of the Vulnerable Software and Affected Versions Postiz affected versions not specified Description Postiz allows signed-in users to request the backend to execute functions on connected channels without restricting which functions can be called. This allows users to trigger internal helper...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 4.9. It stems from xfs’s improper handling of the reflink flag during swap mapping, causing subsequent writes to shared blocks not to be performed via copy-on-write. This may result in corruption of other files sharing those blocks...

Red Hat: CVE-2026-55888: xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames

XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileChooser.SaveFiles method to gain arbitrary file access to non-existing files on the host limited to files the user has access to. The FileChooser.SaveFiles method takes...

Gitroom Postiz code injection vulnerability

A security vulnerability exists in Gitroom Postiz versions 2.23.0 through 2.25.2. This vulnerability stems from the backend failing to restrict permissible functions. Logged-in users can invoke internal helper functions to read arbitrary files on the server, potentially leading to the exposure of...

Flatpak xdg-desktop-portal path traversal vulnerability

Versions of Flatpak prior to xdg-desktop-portal 1.22.1 contain a path traversal vulnerability. This vulnerability arises because the FileChooser.SaveFiles method fails to validate filenames. Malicious sandbox applications can exploit this method to gain arbitrary file access on the host system, b...

CGM CLININET authorization issue vulnerability

CGM CLININET versions 2026.MS3 and earlier contain an authorization issue vulnerability. This vulnerability arises because the rsyncd service grants access solely based on the client’s source IP address, making it susceptible to IP spoofing attacks that bypass authentication checks. Attackers can...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel versions prior to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 6.18.53. This vulnerability arises because the system fails to detect the status of file extension attributes during the early stages of reading a read-only file system; as a...

Linux Distros Unpatched Vulnerability : CVE-2025-55654

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free in the gffilterpidgetpacket function filtercore/filterpid.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying...

Linux Distros Unpatched Vulnerability : CVE-2025-60479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in the StatSFVec2f function /scenemanager/scenestats.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Servic...

Linux Distros Unpatched Vulnerability : CVE-2026-114583

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside...

Node.js Node permissions and access control issues vulnerability

Node.js versions 26.12.0 and earlier contain a permission and access control vulnerability. This issue stems from improper enforcement of the permission model on the file system: when a request path is shorter than the wildcard authorization prefix, the base tree search stops comparing early and...

Linux Distros Unpatched Vulnerability : CVE-2026-98974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF fla...