PT-2026-103520

Name of the Vulnerable Software and Affected Versions ZeroClaw versions prior to 0.8.5 Description Software built with the plugins-wasm feature contains a path traversal issue during plugin installation. The system fails to validate the wasm path manifest field, allowing attackers to trick users...

CVE-2026-101885: Improper Limitation of a Pathname to a Restricted Directory

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasmpath manifest field. Attackers can convince users to install crafted plugins that write arbitrary files to paths outside the plugins director...

PT-2026-103240

Contributor Path Traversal in Creator LMS = 1.2.19 versions...

PT-2026-103527

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A path traversal weakness exists in an administrative import function. This flaw allows an authenticated administrator to write files to arbitrary locations on the server,...

CVE-2026-51570

The modelscope Agentscope software, versions v1.0.0 through v1.0.8 , is vulnerable to a Path Traversal flaw within the insert_text_file function. This vulnerability allows an attacker with low-level privileges to access or manipulate files outside of the intended directory. The impact includes hi...

CVE-2026-51568

The modelscope Agentscope software, specifically versions v1.0.18-v1.0.0 , is vulnerable to a Path Traversal flaw within the write_text_file function. This vulnerability allows for unauthorized access or manipulation of files outside the intended directory. Exploitation details were observed in a...

CVE-2026-102089: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2024-58387: Improper Limitation of a Pathname to a Restricted Directory

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

CVE-2026-101295: Improper Limitation of a Pathname to a Restricted Directory

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785552246)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785552246 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior,...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1767098873)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767098873 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...

AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine (ALMALINUX9.2:CLSA-2026:1768989206)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768989206 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...

Rocky Linux 9.6 [TuxCare] Security Update: spice-vdagent (ALMALINUX9.6:CLSA-2026:1786552586)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786552586 advisory. - A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary file...

CentOS Linux 8.4 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1783079573)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783079573 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1767098873)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767098873 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788953354)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788953354 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1788769322)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788769322 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786469793)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786469793 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1750783474)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750783474 advisory. - An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attackers ...

TencentOS Server 4: iscsi-initiator-utils (TSSA-2026:1057)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1057 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...