CVE-2026-70383: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estonian Information System Authority RIA DigiDoc4 client. This issue affects DigiDoc4: from 4.0.0 before 4.11.0...

CVE-2026-69400: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-77176: External Control of File Name or Path

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over...

CVE-2026-14947: Path Traversal: '../filedir'

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

PT-2026-79096

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws new session enters its error path after evhttp start ws succeeds but bufferevent enable locking fails. evws connection free sees a non-null http server and...

CVE-2026-71492: Improper Limitation of a Pathname to a Restricted Directory

Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...

PT-2026-79208

Name of the Vulnerable Software and Affected Versions Azure Logic Apps affected versions not specified Description An issue exists where improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthorized attacker to elevate privileges over a network. Path...

PT-2026-78878

A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login registration system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be...

The vulnerability of the amcheck extension in the PostgreSQL database management system allows a hacker to enhance their privileges and execute arbitrary code.

The vulnerability of the amcheck extension in the PostgreSQL database management system is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code by manipulating the searchpath parameter...

cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI

cve-2026-47852 - HIGH - Predictable cache directory location allows local ONNX model substitution in Spring AI...

cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization

cve-2026-47862 - MEDIUM - ZipTransformer uses filename header to build workDirectory path without sanitization...

Open Redirect

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Open Redirect in the...

Allocation of Resources Without Limits or Throttling

Overview org.springframework:spring-beans is a package that is the basis for Spring Framework's IoC container. The BeanFactory interface provides an advanced configuration mechanism capable of managing any type of object. Affected versions of this package are vulnerable to Allocation of Resources...

Linux Distros Unpatched Vulnerability : CVE-2026-76217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply...

Wireshark 4.6.x < 4.6.8 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.8. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.8 advisory. - Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76929 ...

AlmaLinux 10 : glib2 (ALSA-2026:57015)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:57015 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd vi...

Wireshark 4.6.x < 4.6.8 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.6.8. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.8 advisory. - Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service CVE-2026-76929 - C12.22...

RockyLinux 10 : glib2 (RLSA-2026:57015)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57015 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd v...

PT-2026-79015

A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outside the intended logs directory. This can lead to unauthorized access to sensitive files and other resources accessible to the web server process. Product is...

PT-2026-80739

Impact The HTTP route handler exported by next-video/request-handler — which the README instructs consumers to mount at /api/video — allows an unauthenticated remote attacker to read arbitrary .json files from the production filesystem of any application following the documented setup. The...