CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

CVE-2026-78208 exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

RHEL 9 : python3.12 (RHSA-2026:59009)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59009 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

PT-2026-81031

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 2.0.4 HashiCorp Vault Enterprise versions prior to 2.0.4 HashiCorp Vault Enterprise versions prior to 1.21.9 HashiCorp Vault Enterprise versions prior to 1.20.14 HashiCorp Vault Enterprise versions prior to...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-80922

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences t...

PT-2026-80918

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

PT-2026-80916

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the...

PT-2026-79855

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

PT-2026-80919

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

PT-2026-80905

A path traversal vulnerability was found in AWX's project archive extraction. The project archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

PT-2026-80927

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache Camel Knative component The Knative consumer in camel-knative maps inbound CloudEvent attributes onto Camel message headers. In binary content mode t...

CVE-2026-70383

A flaw was found in the DigiDoc4 client. This vulnerability, categorized as an Improper Limitation of a Pathname to a Restricted Directory Path Traversal, allows a local attacker to write files to arbitrary locations on the system with active user interaction. By exploiting this flaw, an attacker...

CVE-2026-10053

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-10053

GitLab CE/EE is affected by a path traversal vulnerability in the package registry component that could allow an authenticated user (low privileges) to achieve remote code execution . The vulnerability affects versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The CVSS 3.1 s...

EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

CVE-2026-41843

CVE-2026-41843...

EUVD-2026-64608

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The explo...