PT-2026-69504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the system fails to reject the mapping of a reserved doorbell to a new queue. When creating a user-queue, the user space provides a...

CVE-2026-68274: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

CVE-2026-72903: Improper Limitation of a Pathname to a Restricted Directory

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...

CVE-2026-15238: Authorization Bypass Through User-Controlled Key

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

PT-2026-69848

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.8 Description An authorization bypass exists in the contact management component. Authenticated users can overwrite contact data belonging to other companies or download personal data as a vCard b...

[SECURITY] [DSA 6423-1] kitty security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6423-1 [email protected] https://www.debian.org/security/ Nilesh Patra August 09, 2026 https://www.debian.org/security/faq -...

PT-2026-69307

Name of the Vulnerable Software and Affected Versions Ichigo3766 image-gen-mcp version 0.1.0 Description A path traversal issue exists within the upscale images component in the src/index.ts file. A local attacker can manipulate the output path argument to access or overwrite files outside the...

Debian dsa-6423 : kitty - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6423 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6423-1 [email protected] https://www.debian.org/securit...

Exploit for CVE-2026-71557

CVE-2026-71557: Go-Git path traversal PoC English versionR...

EulerOS 2.0 SP11 : sed (EulerOS-SA-2026-3157)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

EulerOS 2.0 SP11 : sed (EulerOS-SA-2026-3103)

According to the versions of the sed packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When sed is invoked with both -i in-place edit and --follow-symlinks, the function opennextfile performs two separate, non-atomic filesystem operatio...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

CVE-2026-17598

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

EUVD-2026-54517

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the fromtree, reset, or mergetree process. An attacker can overwrite or destroy arbitrary files with a valid git-index blob by injecti...

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Summary IndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

GHSA-4GMW-GG2M-W46P GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Summary IndexFile.fromtree, IndexFile.reset → fromtree and IndexFile.mergetree append caller-influenced treeish strings positionally to git read-tree with no unsafe-option guard, no allowunsafeoptions parameter, and no -- separator. git read-tree --index-output= writes the resulting index to an...

Security Bulletin:Vulnerability in Tar affects IBM Netezza Appliance

Summary The Tar package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2025-45582 Vulnerability Details CVEID:CVE-2025-45582 DESCRIPTION: GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-ste...