CVE-2026-79705: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

PT-2026-93111

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

PT-2026-92514

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...

Linux Distros Unpatched Vulnerability : CVE-2026-17495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-stri...

CVE-2026-57442: Improper Limitation of a Pathname to a Restricted Directory

MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and nodemodules path segments do not match the restriction and pass both...

CVE-2026-76796: External Control of File Name or Path

The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access...

AlmaLinux 10 : rsync (ALSA-2026:67463)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67463 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...

RockyLinux 10 : rsync (RLSA-2026:67463)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67463 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: TLS Certificate Validation Bypass allows...

Linux Distros Unpatched Vulnerability : CVE-2026-79705

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can...

Linux Distros Unpatched Vulnerability : CVE-2026-55846

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure...

PT-2026-91772

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directo...

PT-2026-92419

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

CVE-2026-54077: Improper Limitation of a Pathname to a Restricted Directory

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to...

PT-2026-92403

The static content handlers ResourceService and WebjarService URL decode each path segment and then reject only segments that are exactly "", ".", or "..". A percent-encoded separator %2F lets an attacker smuggle a ../ segment past that filter and escape the configured base, reading resources tha...

PT-2026-91861

Name of the Vulnerable Software and Affected Versions moment versions 2.29.2 through 2.30.1 Description A path-traversal issue exists when a specially crafted non-string object is passed to the moment.locale function. The internal guard assumes the input is a string; however, an object with a mat...

PT-2026-91830

Name of the Vulnerable Software and Affected Versions Weights & Biases wandb versions prior to 0.29.0 Description Insufficient validation of file names received from server responses in the File.download function allows path traversal attacks. An attacker controlling the backend can use directory...

CVE-2026-91771: Improper Limitation of a Pathname to a Restricted Directory

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

CVE-2026-17495: Path Traversal: 'dir/../../filename'

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

PT-2026-92054

Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...

CVE-2026-55374: Improper Neutralization of Special Elements in Output Used by a Downstream Component

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, Request::buildRequestUrl joins values returned by Request::getPathVariables without encoding individual path segments, including the scheme and contentId values used by GetContentDetailsRequest. When ...