Linux Distros Unpatched Vulnerability : CVE-2026-76222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths...

CVE-2026-49244: Improper Limitation of a Pathname to a Restricted Directory

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP download endpoint for a browsable share validates client-supplied files entries with a raw byte-prefix comparison rather than a directory-boundary-aware check. An unauthenticat...

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader

cve-2026-59280 - MEDIUM - Spring Framework Path Traversal via Backslash in SpringTemplateLoader...

Linux Distros Unpatched Vulnerability : CVE-2026-65610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nnn stores homelen variable as uchart, which can only represent values in the range 0-255. An attacker who can influence the victim's execution environment can...

RHEL 10 : rh-podman-desktop (RHSA-2026:57590)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:57590 advisory. Red Hat build of Podman Desktop is a graphical tool for managing containers using Podman. It allows users to run, manage, and configure...

Security update for python-unearth (important)

openSUSE security update: security update for python-unearth ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21606-1 Rating: important References: bsc1275440 Cross-References: CVE-2026-73030 Affected Products: openSUSE Leap 16.0...

CVE-2026-76989: Out-of-bounds Read

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

CVE-2026-63490: Improper Limitation of a Pathname to a Restricted Directory

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

PT-2026-79240

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote attackers can bypass security restrictions because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no...

PT-2026-79011

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT FORCE GET FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about the filesystem structure. Product is no...

PT-2026-79061

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...

PT-2026-79021

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estonian Information System Authority RIA DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0...

PT-2026-79197

Name of the Vulnerable Software and Affected Versions Microsoft Fabric affected versions not specified Description A relative path traversal issue exists that allows an authorized attacker to elevate privileges over a network. Path traversal is a technique used to access files and directories tha...

CVE-2026-55013: Uncontrolled Search Path Element

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally...

CVE-2026-70383: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estonian Information System Authority RIA DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0...

CVE-2026-69400: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-77176: External Control of File Name or Path

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

CVE-2026-14947: Path Traversal: '../filedir'

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

PT-2026-79096

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws new session enters its error path after evhttp start ws succeeds but bufferevent enable locking fails. evws connection free sees a non-null http server and...

CVE-2026-71492: Improper Limitation of a Pathname to a Restricted Directory

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...