PT-2026-137206

Name of the Vulnerable Software and Affected Versions Readest versions prior to 0.11.10 Description In desktop Tauri builds, the download file and upload file commands within the apps/readest-app/src-tauri/src/transfer file.rs file fail to validate the file path variable. The application does not...

CABTrap_OneNote2007

CABTrapOneNote2007 Microsoft Office Onenote 2007 CVE-2014-2815 ".ONEPKG" File Directory Traversal Vulnerability Leads to Arbitrary Code Execution Microsoft Office Onenote 2007 CVE-2014-2815 ".ONEPKG" File Directory Traversal Vulnerability Leads to Arbitrary Code Execution OneNote 2007 is prone to...

CLEANSTART-2026-OZ74550 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-WV58490 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-IP63961 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-ZU91179 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-KK74254 Previously, resolving relative paths containing parent directory ('

Security vulnerability affects the kubernetes package. Previously, resolving relative paths containing parent directory '...

BIT-RCLONE-2026-116195 Rclone before 1.75.2 Path Traversal via translateLink .rclonelink Suffix Trim

Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can resolve outside the destination root. Attackers can plant a directory named ...rclonelink in a sour...

CLEANSTART-2026-RY62864 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

GHSA-H4FR-CMH5-QR62 Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

Impact Fallow expands some globs from the analyzed repository on disk. Before 3.34.0, a segment such as ., .? or .. in such a glob also matched the special .. entry. The glob crate tests .. against a segment that starts with a literal .. Fallow validates plugin glob patterns and refuses absolute...

CLEANSTART-2026-VC29876 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

CLEANSTART-2026-YU32391 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

SUSE CVE-2026-112911

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix dparent walk The WARNONONCE in collectdomainaccesses can be triggered when trying to link a root mount point. This cannot work in practice because this directory is mounted, but the VFS check is done after the call ...

CLEANSTART-2026-YF83540 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

GHSA-VHHQ-M2GM-RWC9 Quasar Framework: App Vite SSG page output paths can escape the configured distribution directory

Summary During an SSG build, page definitions returned by getSsgPages can provide custom dir and filename values. The builder joined those values to build.distDir and wrote the generated page without verifying that the final destination remained inside the distribution directory. Details A page...

EUVD-2026-93568

Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile...

Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests

Impact When generating an API plugin manifest from an attacker-controlled or compromised OpenAPI description, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath into the manifest without validating that it is a safe package-relative file reference. An attacker can supply...

CVE-2026-105795

The Kiota OpenAPI-based HTTP Client code generator versions 1.25.1 through 1.35.0 are vulnerable to an improper limitation of pathnames (CWE-22 ). The software fails to validate the x-ai-capabilities.response_semantics.oauth_card_path value when copying it from an attacker-controlled or compromis...

CLEANSTART-2026-SN29666 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...