Alibaba Cloud Linux 3 : 0323: rsync (ALINUX3-SA-2026:0323)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0323 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-53783: rsync before3.5.0 contains...

HCL BigFix Server 10.0.x <= 10.0.16 / 11.0.x <= 11.0.7 Certificate Validation (KB0134758)

The version of HCL BigFix Server installed on the remote host is 10.0.x through 10.0.16 or 11.0.x through 11.0.7. It is, therefore, affected by a vulnerability in the bundled CA certificate store: - BigFix Platform uses Mozilla CA certificate bundle PEM. Versions of the bundle dated before...

PT-2026-132846

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

CVE-2026-61654: lightdash: Lightdash is an open source business intelligence platform

Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook POST /api/v1/projects/projectUuid/dbt-cloud/webhook has no authentication middleware or signature validation. In packages/backend/src/controllers/projectController.ts,...

Agent Zero security vulnerability

Versions 1.7, 1.8, 1.9, and 1.10 of Agent Zero contain a security vulnerability. This vulnerability arises because the FileBrowser.savetextfile method accepts user-supplied file paths without any normalization or validation, potentially enabling path traversal attacks...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4. These vulnerabilities stem from improper restrictions on pathnames used for restricted directories, potentially allowing unauthenticated attackers to access files outside the intended directo...

CVE-2026-107048: n/a: An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to…

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

EUVD-2026-113265

An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request...

CVE-2026-119130: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values…

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

Apache Ambari 3.0.0 MpackManager Path Traversal

Apache Ambari version 3.0.0 MpackManager contains a path traversal vulnerability that allows an authenticated administrator to write arbitrary files outside the management-pack staging directory. !/usr/bin/env python Apache Ambari 3.0.0 MpackManager Path Traversal Arbitrary File Write Vendor: The...

CVE-2026-113957: Apple: An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content…

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a...

CentOS Linux 7 [TuxCare] Security Update: pcs / pcs-snmp (CENTOS7:CLSA-2026:1793030556)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793030556 advisory. - Sinatra before 2.2.0 does not validate that the expanded path matches publicdir when serving static files. CVE-2022-29970 Note that Nessus has...

UBUNTU-CVE-2026-118693

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or / filename and no data, so saving embeds...

Linux Distros Unpatched Vulnerability : CVE-2026-118693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::createimagefromxml that trusts unvalidated embedded-file 'filename'...

Python < 3.11.18 / 3.12.x < 3.12.16 / 3.13.x < 3.13.18 / 3.14.x < 3.14.10 / 3.15.x < 3.15.2 / 3.16.x < 3.16.0 Multiple Vulnerabilities

The version of Python installed on the remote Windows host is prior to 3.11.18, or is 3.12.x prior to 3.12.16, or 3.13.x prior to 3.13.18, or 3.14.x prior to 3.14.10, or 3.15.x prior to 3.15.2, or 3.16.x prior to 3.16.0. It is, therefore, affected by multiple vulnerabilities: - tarfile.tarfilter...

PT-2026-132376

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

PT-2026-132797

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop for macOS to execute arbitrary commands with root privileges on the host device...

Progress Software WS_FTP Server path traversal vulnerability

Security vulnerabilities exist in Progress Software WSFTP Server versions prior to 2024.0.7 and prior to 2025.0.4. These vulnerabilities stem from a path traversal issue, which may allow the delegated host administrator to access or modify files outside their authorized scope...

Progress Software WS_FTP Server path traversal vulnerability

Versions prior to Progress Software WSFTP Server 2024.0.6 and 2025.0.3 contain a path traversal vulnerability. This vulnerability stems from improper path name restrictions in the Ad Hoc Transfer component, potentially allowing authenticated users to access files outside the intended directory...

CVE-2026-113692: BMC BMC IT Service Management Suite: Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and…

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory...