EUVD-2026-57071

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-19594 Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-19594

The CVE concerns the Snowflake Python API (snowflake.core) prior to version 1.13.0. It describes two weaknesses arising from insufficient input sanitization: path traversal (CWE-22) via unencoded “..” path segments and HTTP parameter pollution (CWE-141) via unencoded characters in query string va...

CVE-2026-71852 vulnerabilities

Vulnerabilities for packages: open-webui...

PT-2026-71340

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote images for Netlify's Image CDN allowlist. In...

PT-2026-71308

Name of the Vulnerable Software and Affected Versions LXD affected versions not specified Description A path traversal vulnerability exists during backup import and restore operations. The issue occurs because the software fails to validate instance and storage volume names within the archive...

PT-2026-71105

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

PT-2026-70996

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

PT-2026-71202

Joomla 6.1.1 contains a path traversal vulnerability in the com joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with...

Linux Distros Unpatched Vulnerability : CVE-2026-73234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore in src/App/PropertyFile.cpp concatenates an...

PT-2026-71302

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

PT-2026-71156

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal vulnerability...

PT-2026-76562

Summary ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or...

PT-2026-71158

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote authenticated attacker can obtain sensitive information because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no information...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3548-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3548-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

AlmaLinux 9 : iscsi-initiator-utils (ALSA-2026:53844)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:53844 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

RockyLinux 10 : iscsi-initiator-utils (RLSA-2026:53845)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:53845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

RHEL 9 : iscsi-initiator-utils (RHSA-2026:53844)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53844 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as th...

PT-2026-71106

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

PT-2026-71339

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 8.2.13 Description Authenticated attackers can read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the download export method. By using ../ sequences, an attack...