pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-63808

A flaw was found in the Linux kernel's exFAT filesystem driver. A local attacker could exploit a use-after-free vulnerability in the exfatfinddirentry function. This occurs because a buffer is prematurely released while still being referenced, which can be triggered by processing a specially...

CVE-2026-63804

A flaw was found in the Linux kernel's GFS2 file system. This use-after-free vulnerability occurs when the gfs2qddealloc function attempts to access memory that has already been released during the unmounting process. This can lead to system instability or crashes, potentially resulting in a deni...

CVE-2026-64187

CVE-2026-64187 affects the Linux kernel’s XFS log recovery. If the first operation of a transaction is a bare header (len == sizeof(struct xfs_trans_header)) and xlog_recover_add_to_trans() adds an item with no region (ri_buf is NULL), the item can stay on r_itemq with ri_cnt == 0. During recover...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

pulpcore: pulpcore: relative_path_validator bypass via directory traversal in FilesystemExport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-12701

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-25039

Summary (CVE-2026-25039): Parsec, a cloud-based file sharing app, does not sanitize the workspace name when creating a mountpoint in Windows, allowing a UNC path to be used as the workspace name. The root cause is that UNC paths may contain backslashes, and if the UNC target is invalid or unavail...

CVE-2026-25039 The application evaluate UNC path in workspace name

Parsec is a cloud-based application for simple and cryptographically secure file sharing. The application does not sanitize the workspace name, creating a vulnerability if that workspace name is a UNC path. When creating mountpoint in the windows filesystem to mount the workspace of an...

CVE-2026-12701 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

EUVD-2026-45954

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-12701

The Pulpcore CVE-2026-12701 vulnerability affects the relative_path_validator used in FilesystemExport. An authenticated administrator can supply a crafted relative_path containing embedded directory traversal sequences (for example, look­ing/normal/../../../../etc/shadow) that bypasses checks an...

CVE-2026-12701 Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

CVE-2026-12701

A path traversal vulnerability was found in pulpcore. The relativepathvalidator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relativepath containing...

JLSEC-2026-774 `sniff_csv` provides filesystem access even when `enable_external_access` is disabled in duckdb

Summary Content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. Details During a pentest, a security researcher was able to access environment variable data and other system data by using the sniffcsv function, even though we set enableexternalaccess ...

Linux Distros Unpatched Vulnerability : CVE-2026-64063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfs: Fix streaming write being overwritten In order to avoid reading whilst writing,...

PT-2026-61593

A path traversal vulnerability was found in pulpcore. The relative path validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative path containin...

PT-2026-61598

Name of the Vulnerable Software and Affected Versions Parsec affected versions not specified Description Parsec is a cloud-based application for secure file sharing. The application fails to sanitize the workspace name when creating a mountpoint in the Windows filesystem to mount an organization'...

RHEL 8 / 9 : Satellite 6.16.11 Async Update (Important) (RHSA-2026:42082)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42082 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessi...