CVE-2026-84800: Missing Authorization

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

PT-2026-84673

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

CVE-2026-84668: Improper Access Control

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...

PT-2026-84774

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

PT-2026-84790

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups...

PT-2026-84789

Jenkins Job Configuration History Plugin 1367.vc8fa b 15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings...

CVE-2026-77788: Authorization Bypass Through User-Controlled Key

The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged...

Unsafe deserialization allows overwriting other agents

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document. This allows attackers with...

Unsafe deserialization allows overwriting configuration objects

In Jenkins, fields declared transient are excluded from serialization but are still read back during deserialization for backward compatibility with existing configuration files. In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization,...

MiracleLinux 9 : tar-1.34-13.el9_8 (AXSA:2026-1733:03)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1733:03 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-09-02: High SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability Medium SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization High SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration High SECURITY-3967 /...

AlmaLinux 10 : tar (ALSA-2026:61586)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:61586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escap...

MiracleLinux 9 : gzip-1.12-2.el9_8 (AXSA:2026-1737:01)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1737:01 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via...

CVE-2026-84374

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

EUVD-2026-66380

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374 Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

Laravel Excel provides supercharged Excel exports and imports in Laravel. From 3.1.8 until 3.1.70, in src/Files/Disk.php the Maatwebsite\Excel\Files\Disk::copy method resolves the caller-controlled $destination supplied through Excel::store, $export-store, or storeExcel against the process workin...

CVE-2026-84374

Laravel Excel (Maatwebsite) versions 3.1.8 through 3.1.70 contain a path-traversal flaw in Maatwebsite\Excel\Files\Disk::copy() (src/Files/Disk.php). The method resolves a caller-controlled $destination passed via Excel::store(), $export->store(), or storeExcel() against the process working di...

CVE-2026-32637

A flaw was found in Velero, an open-source tool for managing Kubernetes backups. An attacker who compromises the backup object-storage backend can upload a specially crafted malicious backup file. During the restore process, this malicious file can exploit a path traversal vulnerability to...

SUSE CVE-2026-82393

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...