Linux Distros Unpatched Vulnerability : CVE-2026-73253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can...

PT-2026-79461

Name of the Vulnerable Software and Affected Versions Atlantis versions 0.19.8 through 0.44.0 Description Atlantis fails to consistently validate user-controlled workspace values provided via the repository-level atlantis.yaml configuration or the authenticated '/api/plan' endpoint before joining...

CVE-2026-77086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operatio...

CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-62677: Improper Limitation of a Pathname to a Restricted Directory

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, an authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing osenv.cwd value because omnigent/spec/parser.py stores the value verbatim and...

Linux Distros Unpatched Vulnerability : CVE-2026-63385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Vulnerability (ESA-2026-94)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-94 advisory. - Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of...

Linux Distros Unpatched Vulnerability : CVE-2026-32791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Untrusted search path for some IntelR Performance Counter Monitor IntelR PCM before version tag 202604 within Ring 3: User Applications may allow an escalation ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102033 advisory. In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpannhcdouncompression looks up an NHC...

SUSE SLES15 Security Update : erlang (SUSE-SU-2026:3645-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3645-1 advisory. - CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. - CVE-2026-42789: publickey application...

Linux Distros Unpatched Vulnerability : CVE-2026-68554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an...

PT-2026-79492

Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.3.0 through 0.10.0 Description LeafWiki contains a path traversal flaw within the asset rename functionality. This issue occurs because the application fails to properly sanitize user-supplied file paths during the rename...

PT-2026-79397

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

PT-2026-79352

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

PT-2026-79392

is path trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswithparent path, without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allow...

CVE-2026-77751: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

CVE-2026-77815: Improper Link Resolution Before File Access

toabspath in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by ispathtrusted in scripts/iib/api.py while...

CVE-2026-54134: External Control of File Name or Path

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

Linux Distros Unpatched Vulnerability : CVE-2026-63380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error pat...

CVE-2026-48752: External Control of File Name or Path

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...