AlmaLinux 9 : glib2 (ALSA-2026:55440)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55440 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via...

Linux Distros Unpatched Vulnerability : CVE-2026-72196

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fs/ntfs3: bound copylcns dp-pagelcns index in analysis pass In logreplay's analysis pass, after finddp returns a valid DIRPAGEENTRY for the targetattr, targetv...

Linux Distros Unpatched Vulnerability : CVE-2026-73646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18,...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

CVE-2026-69148

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...

GHSA-GQCH-G4W5-7QCW MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

CVE-2026-75111

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system...

CVE-2026-75482

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

CVE-2026-75104

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling...

CVE-2026-71518

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-54336

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

EUVD-2026-60470

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-71518

Typemill before 2.26.0 has an authorization bypass in the media file download route: the restriction check keys on the raw, un-normalized request path ($restrictions['media/files/' . $args['params']]) while file_get_contents($base . $params) resolves via the OS-normalized path. Since validate() o...

CVE-2026-71518 Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double...

CVE-2026-54336

JumpServer (open source bastion host and O&M security audit system) is affected by a path traversal vulnerability in the KoKo Web Terminal SFTP feature (versions 4.8.0 through 4.10.17). An authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths that cause...

CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...