CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

PT-2026-89000

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-71805

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

CVE-2026-86099: Improper Limitation of a Pathname to a Restricted Directory

Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and...

CVE-2026-87766: Improper Link Resolution Before File Access

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is...

CVE-2026-21103: Path Traversal: '.../...//'

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege...

CVE-2026-78485: Improper Limitation of a Pathname to a Restricted Directory

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

CVE-2026-86775: Improper Limitation of a Pathname to a Restricted Directory

knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not neutralize ../...

CVE-2026-15913: Relative Path Traversal

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-71805: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Path Traversal (ESA-2026-159)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, or 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-159 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Security Update for Microsoft Visual Studio Code (September 2026)

The remote host has an application installed that is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-784...

RHEL 8 : glib2 (RHSA-2026:65762)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65762 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 8 : glib2 (RHSA-2026:65771)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65771 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

RHEL 7 : glib2 (RHSA-2026:65773)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65773 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

TencentOS Server 3: python3.12 (TSSA-2026:0989)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0989 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Kibana 7.x / 8.x < 8.19.16 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Path Traversal (ESA-2026-160)

The version of Kibana installed on the remote host is 7.11.0 through 7.17.29, or 8.x prior to 8.19.16, or 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-160 advisory. - Improper Limitation of a Pathname to a Restricted...

CVE-2026-21092: Path Traversal: '.../...//'

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege...

PT-2026-89202

Name of the Vulnerable Software and Affected Versions GitHacker versions prior to 1.1.8 Description GitHacker fails to validate path segments parsed from an attacker-controlled .git/HEAD file before joining them to the output directory. A malicious server can coerce the tool into reading arbitrar...

CVE-2026-88069: Improper Limitation of a Pathname to a Restricted Directory

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...