PT-2026-80852

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-5006: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in HashiCorp Vault and Vault Enterprise “Vault” such that an authenticated attacker may manipulate an identity value referenced by a templated policy path to gain unintended access to Vault paths. An attacker who can control the referenced identity value may include...

CVE-2026-78417: Insufficient Verification of Data Authenticity

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES...

ALSA-2026:58901 Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-76844: Improper Limitation of a Pathname to a Restricted Directory

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

PT-2026-79855

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

PT-2026-80855

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

PT-2026-79819

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files...

PT-2026-80922

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated users can read arbitrary files by providing crafted filenames containing directory traversal sequences to the export download endpoint. By manipulating the filename parameter, an...

PT-2026-80916

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the...

PT-2026-80918

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

PT-2026-80919

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

PT-2026-80905

A path traversal vulnerability was found in AWX's project archive extraction. The project archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

The vulnerabilities of the `cluster.unmerge_info()` and `process_files_from_worker()` functions on the security monitoring and threat detection platform Wazuh allow attackers to execute arbitrary code.

The vulnerability of the cluster.unmergeinfo and processfilesfromworker functions of the security monitoring and threat detection platform Wazuh is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary cod...

The vulnerability of the sm_name() function in the src/GitPython/git/objects/submodule/util.py file of the Python library for interacting with Git repositories in GitPython, which allows a attacker to compromise the integrity and accessibility of protected information.

The vulnerability of the smname function in the src/GitPython/git/objects/submodule/util.py file of the Python library for interacting with Git repositories in GitPython is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow a malicious...

ROS-20260824-73-0003

The vulnerability in the incus is related to incorrect external management of the name or file. Exploiting this vulnerability can allow an attacker to increase their privileges...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

MiracleLinux 9 : glib2-2.68.4-19.el9_8.9 (AXSA:2026-1638:13)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1638:13 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetym...

CVE-2026-78381: Improper Limitation of a Pathname to a Restricted Directory

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...