CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

CVE-2026-69127 Kirby: System path exposure from error messages in the REST API

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview github.com/go-git/go-git/v5/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intend...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended reference storage by supplying specially crafted reference names containing path traversal sequences. Th...

GHSA-QGQ7-7HM3-Q39J go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...

Directory Traversal

Overview github.com/go-git/go-git/plumbing is a highly extensible git implementation library written in pure Go. Affected versions of this package are vulnerable to Directory Traversal via the processing of reference names in dotgit. An attacker can modify or overwrite files outside the intended...

CVE-2026-56794

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-56794

CVE-2026-56794 affects Dell OpenManage Server Administrator, prior to version 11.1.0.2. It is a Relative Path Traversal vulnerability that could be exploited by a low-privileged attacker with remote network access to gain filesystem access. The provided metrics assign a CVSS v3.1 base score of 6....

CVE-2026-56794

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

SUSE CVE-2026-64594

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However...

SUSE CVE-2026-64596

In the Linux kernel, the following vulnerability has been resolved: libfs: set SBINOEXEC and SBINODEV by default in initpseudo Since commit 1e7ab6f67824 "anoninode: rework assertions", pathnoexec warns when an anonymous-inode file is mmap'd from a superblock that has not set SBINOEXEC. dma-buf...

EUVD-2026-54277

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

CVE-2026-7867

Affected software: udisks2. Vulnerability: insufficient authorization check on the as-user parameter in org.freedesktop.UDisks2.Filesystem.Mount() allows a local attacker to spoof as-user and mount on behalf of arbitrary users, enabling local privilege escalation via mount point namespace manipul...

CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

Security update for nodejs22

This update for nodejs22 fixes the following issues: Update to 22.23.2. CVE-2026-54272: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses allows for bypass of SSRF and trust- boundary checks bsc1272882. CVE-2026-56846: HTTP/2 retained headers can bypass maxSessionMemory limits...