PT-2026-89163

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

PT-2026-88967

Name of the Vulnerable Software and Affected Versions Dell SCG 5.0 Appliance versions prior to 5.36.00.16 Dell SCG 5.0 Application versions prior to 5.36.00.00 Description A Relative Path Traversal issue exists where an unauthenticated attacker with remote access can gain unauthorized access to t...

PT-2026-88837

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege...

PT-2026-88882

The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files...

PT-2026-89044

🚨 CVE-2026-86775 knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not...

CVE-2026-71805

A critical arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0 . Unauthenticated remote attackers can exploit the directory parameter in the POST /app-api/infra/file/upload endpoint to upload arbitrary files and write them outside the intended storage directory. Explo...

RHEL 7 : glib2 (RHSA-2026:65773)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65773 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 8 : glib2 (RHSA-2026:65771)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65771 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)

The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160 advisory. - Improper Limitation of a Pathname to a Restricted...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Path Traversal (ESA-2026-159)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, or 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-159 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

CVE-2026-79728: Relative Path Traversal

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

TencentOS Server 3: python3.12 (TSSA-2026:0989)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0989 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Security Update for Microsoft Visual Studio Code (September 2026)

The remote host has an application installed that is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-784...

PT-2026-89107

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

PT-2026-89157

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

PT-2026-89215

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

PT-2026-89180

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-87766: Improper Link Resolution Before File Access

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

PT-2026-88826

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...