CVE-2026-74859 Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EUVD-2026-72673

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859

gnome-tweaks contains a path traversal vulnerability in its shell theme installer. The installer extracts user-supplied ZIP archives without validating archive member paths, allowing a crafted theme archive to write files outside ~/.themes via ../ sequences, absolute paths, or symlink entries. Th...

CVE-2026-74859 Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

PT-2026-87831

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A heap-based buffer overflow occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruption issu...

PT-2026-87203

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A use-after-free condition occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue where an...

PT-2026-87971

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

Linux Distros Unpatched Vulnerability : CVE-2026-74859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can...

CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-62694: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-54611: Improper Control of Generation of Code

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-71339: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-77894: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2026-87192

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-69441: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2026-87847

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description Improper validation of the integrity check value in Windows Installer allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no...

PT-2026-88648

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper state validation in the Installer allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-87470

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A race condition occurs in Windows Installer due to improper synchronization when using a shared resource. This allows an authorized attacker to elevate privileges locally. A race...

PT-2026-87018

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...