EUVD-2026-42895

PraisonAI: Project config can auto-save agent output outside the project root...

openssh: OpenSSH: sftp client allows attacker to control downloaded file location

A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...

[SECURITY] [DLA 4825-1] suricata-update security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4825-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz October 06, 2026 https://wiki.debian.org/LTS -...

Debian dla-4825 : suricata-update - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4825 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4825-1 [email protected] https://www.debian.org/lts/security/...

Security Bulletin: Due to the use of Apache Ant, IBM Sterling Control Center is vulnerable to Relative Path Traversal (CVE-2026-78254)

Summary Apache Ant is used by IBM Sterling Control Center as part of dependency in ant-1.10.11.jar Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to...

CVE-2025-41753 Path traversal in dynamically created BACnet File Objects

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

ABB Protection and Control IED Manager PCM600

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for...

CVE-2026-51879

The deeptutor 1.4.0 software contains an authorization bypass vulnerability within the TutorBotManager.write_bot_file function. This flaw allows a remote caller to manipulate a user-controlled object identifier to enumerate bot IDs and overwrite whitelisted control files belonging to other bots v...

Rocky Linux 9.6 [TuxCare] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / ant-apache-oro / etc (ALMALINUX9.6:CLSA-2026:1789746085)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789746085 advisory. - The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it ...

CVE-2026-102904

A flaw was found in JupyterLab. When processing extension uninstallation requests, user-supplied package names are passed to the underlying package manager without properly filtering command-line options. An authenticated user with extension management access can exploit this argument injection...

Electron: Local race condition in Squirrel.Mac update installation on macOS

Impact On macOS, Electron bundles the Squirrel.Mac auto-update framework, whose privileged ShipIt helper performs the final step of an update as root. A local attacker could cause that helper to overwrite a different application's files, as root, instead of the app that started the update...

CVE-2026-102242 Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases

Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...

CVE-2026-86334

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...

PT-2026-99870

Name of the Vulnerable Software and Affected Versions dbgate versions 6.x through 6.8.1 dbgate versions 7.0.x through 7.0.2 dbgate versions 7.1.x through 7.1.8 dbgate versions 7.2.x through 7.2.5 dbgate versions 7.3.x through 7.3.1 Description A path traversal issue exists in the save-uploaded-fi...

CVE-2026-100747

The Joomla Extension - svenbluege.de - Event Gallery extension (versions

CVE-2026-100747: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name...

PT-2026-99531

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description Cross-Site Request Forgery CSRF occurs during the image upload process due to the absence of a CSRF token check. This allows a third-party site to upload files to an event and overwrite existin...

PT-2026-99308

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description A path traversal issue exists in the 'checkoutRepo' endpoint. Authenticated administrators can overwrite arbitrary JSON files in pre-existing kernel-writable directories outside the workspace boundari...

BIT-RCLONE-2026-79781 rclone serve s3 Path Traversal via dot-dot object keys

rclone serve s3 before 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like ../root-secret.txt to escape the bucket namespace and access files in t...

CVE-2026-78394 Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...