Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-94)

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources Description: Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal CAPEC-139. Kibana Fleet accepted a user-supplied...

postcss: PostCSS: Information disclosure via path traversal in source map auto-loading

A flaw was found in PostCSS. An attacker can exploit a path traversal vulnerability by providing specially crafted sourceMappingURL values in untrusted CSS files. This allows the attacker to disclose sensitive sourcesContent from arbitrary .map files accessible on the system, leading to informati...

cpio: GNU cpio: Path Traversal allows creating hard links outside intended directory via malicious tar archives.

A flaw was found in GNU cpio. This vulnerability, known as Path Traversal, occurs during the extraction of tar archives in copy-in mode when the --no-absolute-filenames option is used. A remote attacker could craft a malicious tar archive containing a hard-link entry with an absolute path. This...

Security Bulletin: Vulnerability in fast-uri affects IBM Netezza Appliance

Summary The fast-uri package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-6321 Vulnerability Details CVEID:CVE-2026-6321 DESCRIPTION: fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its...

RLSA-2026:54268 Important: python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

SUSE CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

PT-2026-71935

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

PT-2026-71679

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description An issue exists in the Zimbra Briefcase document editing functionality where the packages parameter is not properly validated. An authenticated attacker can use a crafted path...

PT-2026-71879

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

PT-2026-71821

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability...

TencentOS Server 3: sssd (TSSA-2026:0846)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0846 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-71852

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths...

PT-2026-71440

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory,...

PT-2026-71840

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

PT-2026-71704

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

PT-2026-71694

Name of the Vulnerable Software and Affected Versions Data::MuForm::Localizer versions prior to 0.06 Description Remote code execution is possible because the load lexicon function interpolates the language attribute into the catalog filename without validating that it is a bare locale tag. An...

PT-2026-71624

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path traversal issue exists when using --relative mode. A malicious sender can write files outside the intended destination directory tree by crafting relative paths containing symlink components. Th...

PT-2026-71631

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths...

PT-2026-71880

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

iscsi-initiator-utils security, bug fix, and enhancement update

6.2.1.11-1.git4b3e853.0.1.el98.2 - iscsi validate interface IP against target address family Orabug: 39491394 - iscsi delay reconnect until interface has valid IP Orabug: 38441836 - Correct the typos in email addresses in changelog in OL9.5 Orabug: 37910459 - Change the order of restart iscsi...