PT-2026-78744

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can move files readable...

CVE-2026-76358: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file...

The vulnerability of the Microsoft .NET Framework software platform, related to incorrect path name restrictions, allows attackers to escalate their privileges.

The vulnerability of the Microsoft .NET Framework software platform is related to incorrect restrictions on path names in the directory structure. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2026-78481

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description In the tarfile module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves th...

CVE-2026-63188: Improper Limitation of a Pathname to a Restricted Directory

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

PT-2026-78785

Name of the Vulnerable Software and Affected Versions Splunk SOAR versions prior to 8.6.0 Description A path traversal issue exists in the archive extraction routine during app installation. This occurs because the system fails to validate that extracted file paths remain within the intended...

PT-2026-78510

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.end receiving file in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUH PATH. A syn i w m e...

CVE-2026-19672: Improper Limitation of a Pathname to a Restricted Directory

The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...

PT-2026-78443

Name of the Vulnerable Software and Affected Versions Ground Station versions prior to 0.4.13 Description An unauthenticated Socket.IO command configure-sdr accepts a recordingPath for the sigmf-playback SDR. The system stores this path without validation in backend/handlers/entities/sdr.py, and...

Linux Distros Unpatched Vulnerability : CVE-2026-74326

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix resource leak in probe error path When pcimiomapregion or devmkmemdu...

PT-2026-79982

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16...

CVE-2026-76359: Improper Limitation of a Pathname to a Restricted Directory

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

ALSA-2026:57015 Moderate: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...

RHEL 10 : glib2 (RHSA-2026:57015)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57015 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

CVE-2026-70666

creationtimestamp| type| source ---|---|--- 2026-08-18 22:35:18+00:00| published-proof-of-concept| https://github.com/Netflix/lemur/security/advisories/GHSA-xpmj-wjcp-6pww 2026-08-19 09:32:00+00:00| seen| https://gist.github.com/alon710/f8eaee2020ed8f819add6f9d1de77bf8...

CVE-2026-73974

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-52875

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync,...

CVE-2026-48796

CefSharp provides .NET bindings for the Chromium Embedded Framework for Windows Forms and Windows Presentation Foundation applications. Prior to version 148.0.90, CefSharp/SchemeHandler/FolderSchemeHandlerFactory.cs used filePath.StartsWithrootFolder, StringComparison.OrdinalIgnoreCase to decide...