EUVD-2026-85920

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-90959

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-75104 DESCRIPTION: Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers c...

CVE-2026-81547 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81547 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

EUVD-2026-86015

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

CVE-2026-81547

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a path traversal vulnerability (CWE-22), which could allow a remote authenticated attacker to execute arbitrary commands. The vulnerability has a CVSS base score of 8.8 . To remediate this issue, IBM strongly recommends upgrading to Dat...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

CVE-2026-77825

IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 is vulnerable to a path traversal flaw in the Admin API log-download endpoint (GET /v1/admin/logs/file). The vulnerability stems from the use of str.startswith() for path confinement, which lacks proper boundary validation. This allows an ...

CVE-2026-77825 IBM ContextForge MCP Gateway is affected by path traversal

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

EUVD-2026-86011

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

Security Bulletin: IBM ContextForge MCP Gateway is affected by path traversal

Summary IBM ContextForge MCP Gateway Admin API contains a path traversal vulnerability in the administrative log download handler /v1/admin/logs/file where an authenticated user with administrative privileges can retrieve files from sibling directories sharing a common path prefix with the log...

CVE-2026-19532

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...

CVE-2026-19532 Path Traversal in HAVELSAN's Liman MYS

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...

CVE-2026-19532

A Path Traversal vulnerability exists in HAVELSAN Inc. Liman MYS affecting versions 2.3.2 through 2.3.4-1124 . This flaw allows an attacker to bypass directory restrictions and access unauthorized files. No specific exploit details, root cause functions, or remediation steps are provided in the d...

EUVD-2026-85857

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...

CVE-2026-19532 Path Traversal in HAVELSAN's Liman MYS

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...

Path Traversal

Mockoon is vulnerable to Path Traversal. The vulnerability is due to insufficient path validation using a prefix check without a path-separator boundary, which allows an unauthenticated attacker to use ../ traversal sequences to access and read files from sibling directories outside the intended...

CVE-2026-78312

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-77193

The eesyID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the id2wppath parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...