CVE-2026-114572

The Domain Login Restrict module for Drupal (versions 0.0.0 to 1.5.0) is vulnerable to an Authentication Bypass (CWE-288) because it fails to sufficiently enforce login restrictions when users authenticate via methods other than the standard login form. This allows users to log in to domains they...

CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

EUVD-2026-113498

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118561 Single Content Sync - Critical - External control of file name or path - SA-CONTRIB-2026-274

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

CVE-2026-118561

The Single Content Sync module for Drupal (versions 0.0.0 to 1.4.19 ) is vulnerable to an External Control of File Name or Path (CWE-73) issue. The root cause is the module's failure to sufficiently validate file sources and destinations during content imports. An attacker with the import single ...

CVE-2026-118572 OAuth Login - OAuth OIDC SSO - Critical - Authentication bypass - SA-CONTRIB-2026-284

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1...

CVE-2026-118554 OpenID Connect Client - Moderately critical - Improper authentication - SA-CONTRIB-2026-287

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2021-41773

CVE-2021-41773 apache http server vulnerability only works 2.4.49 requirement settings httpd.conf ... LoadModule cgimodule modules/modcgi.so uncomment this line ... AllowOverride none Require all denied comment out this line or set Require all granted ... References...

SUSE CVE-2026-118667

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the...

CVE-2026-118554: Drupal OpenID Connect Client: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1...

CVE-2026-119979: Element Labs LM Studio: LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that…

LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository...

PT-2026-134155

pgAdmin 4 runs pg dump, pg restore, pg dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGE DIR, not under a SHARED STORAGE directory, which ordinary users can upload files...

Linux Distros Unpatched Vulnerability : CVE-2026-119135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created wit...

RHEL 9 : mrtg (RHSA-2026:92071)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:92071 advisory. The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provid...

CVE-2026-116240: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which…

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-118561: Drupal Single Content Sync: External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal

External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content Sync versions: from 0.0.0 to 1.4.19...

PT-2026-133625

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory, as well as read and overwrite files on the server via a crafted URL...

CVE-2010-20125: DedeCMS: DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated…

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requireonce. Attackers can supply path traversal sequences ../../ to include...

PT-2026-133614

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require once. Attackers can supply path traversal sequences ../../ to include...

PT-2026-133731

Name of the Vulnerable Software and Affected Versions LM Studio versions prior to 0.4.22+1 Description A path traversal issue exists in the model downloader's resolveDownloadRequest function. This allows attackers to write files outside the designated models directory by using backslash-separated...