CVE-2026-97024

A path traversal vulnerability exists in Flatpak 's handling of the files/etc directory during app deployment. A malicious Flatpak app can exploit this to empty or replace critical host system files—such as passwd , group , machine-id , or resolv.conf —with a symlink. In system-wide installations...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

EUVD-2024-55774

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

PT-2026-102517

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

Linux Distros Unpatched Vulnerability : CVE-2026-87798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 o...

CVE-2026-70356: Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-102810: Improper Limitation of a Pathname to a Restricted Directory

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

PT-2026-102779

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

PT-2026-102904

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-102424: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

PT-2026-102639

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1 Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen - may be interpreted as Mercurial...

PT-2026-102946

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description A path traversal issue in the WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted managemen...

PT-2026-102446

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.4 Description A path traversal issue exists in the way Flatpak handles the files/etc directory during app deployment. This allows a malicious application to empty or replace critical host system files, such as...

CVE-2026-97024: UNIX Symbolic Link (Symlink) Following

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-86035: Improper Neutralization of Special Elements used in an OS Command

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

PT-2026-102454

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

PT-2026-108581

Security vulnerability affects the argo-workflows package. launch-editor allows users to open files with line numbers in editor from Node...

Linux Distros Unpatched Vulnerability : CVE-2024-58386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The...

CVE-2026-102366: Unrestricted Upload of File with Dangerous Type

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept arbitrary file types without validation. Attackers with any authenticated token can upload HTML or SVG files that execute scripts in administrator browsers...