52485 matches found
EUVD-2026-62902
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could read JavaScript files outside the Splunk Web static directory. The vulnerability is possible because Splunk Web does not restrict static file requests to the configured static directory...
EUVD-2026-62910
In Splunk Enterprise versions below 10.4.2, a user with a high-privilege Splunk role that can manage search head clustering could use the search head cluster member bundle Representational State Transfer REST API to write files to locations that the user account running Splunk Enterprise can writ...
EUVD-2026-63124
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could move files that the user account running Splunk Enterprise can read into a lookup that the user controls. The user could then access all relevant data and...
UBUNTU-CVE-2026-76222
GitPython before 3.1.58 fails to validate submodule names from .gitmod...
PT-2026-79036
Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...
PT-2026-79079
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mg ssi function in src/ssi.c concatenates the directive argument into a filesystem pa...
PT-2026-79053
Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation...
Linux Distros Unpatched Vulnerability : CVE-2026-76222
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths...
Security update for python-unearth (important)
openSUSE security update: security update for python-unearth ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21606-1 Rating: important References: bsc1275440 Cross-References: CVE-2026-73030 Affected Products: openSUSE Leap 16.0...
PT-2026-79061
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
PT-2026-79208
Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
PT-2026-79197
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...
PT-2026-79240
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restricted directory...
Linux Distros Unpatched Vulnerability : CVE-2026-76217
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove and Head.checkout. Attackers can supply...
UBUNTU-CVE-2026-65611
nnn does not sanitize the path variable. An attacker can createa direc...
UBUNTU-CVE-2026-65612
nnn does not sanitize the filename variable. An attacker can place a f...
UBUNTU-CVE-2026-76219
GitPython versions before 3.1.58 contain an arbitrary file overwrite v...
UBUNTU-CVE-2026-19672
The tarfile modules tar and data extraction filters created director...
PT-2026-79051
Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1 https://github.com/apache/inlong/pull/12146...