SUSE CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

SUSE CVE-2026-53796

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

SUSE CVE-2026-53803

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject...

SUSE CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...

SUSE CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-59781: Uncontrolled Search Path Element

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions. If the target directory allowed unauthorized users to modify its contents, an attacker could place a malicious DLL that could...

PT-2026-77027

DataEase is an open source data visualization and analysis tool. Versions prior to 2.10.23 have a path traversal vulnerability. The root cause is that on Windows, the FILE SEPARATOR is , while the server only filters the / character during string truncation. The vulnerability has been fixed in...

CVE-2026-50186: Improper Limitation of a Pathname to a Restricted Directory

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename. In server/api/controllers/boards/download.js, the decoded inputs.filename value is...

PT-2026-78229

Name of the Vulnerable Software and Affected Versions linuxfabrik-lib versions prior to 6.1.0 Linuxfabrik Monitoring Plugins versions prior to 7.0.0 Description The lib.lftest.test function in linuxfabrik-lib improperly handles the --test CSV argument by treating its first or second element as a...

PT-2026-77227

Name of the Vulnerable Software and Affected Versions Red Hat Advanced Cluster Management for Kubernetes affected versions not specified Description A flaw in the submariner-operator component allows a cluster administrator or any user with permissions to modify the Submariner Custom Resource CR ...

PT-2026-76922

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-47630: Absolute Path Traversal

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution...

PT-2026-77249

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS IsValidName and unsafe...

CVE-2026-52610

An arbitrary file write/directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with...

CVE-2026-47699: Improper Limitation of a Pathname to a Restricted Directory

Confidential Containers Guest Components provides guest tools and components for confidential container workloads. From 0.16.0 until 0.20.0, a crafted OCI image layer can make imagers::stream::unpack::unpack create a hardlink outside its destination directory. In image-rs/src/stream/unpack.rs,...

CVE-2026-75830: External Control of File Name or Path

grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...

CVE-2026-52872: Improper Limitation of a Pathname to a Restricted Directory

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its...

Amazon Linux 2 : spice-vdagent, --advisory ALAS2-2026-3863 (ALAS-2026-3863)

The version of spice-vdagent installed on the remote host is prior to 0.14.0-18. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3863 advisory. A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101993)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101993 advisory. In the Linux kernel, the following vulnerability has been resolved: intelth: fix device leak on output open Make sure to drop the reference taken when looking up the...

Linux Distros Unpatched Vulnerability : CVE-2026-72456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If...