70700 matches found
AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787334245)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787334245 advisory. - Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip- style attachments...
AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine (ALMALINUX9.2:CLSA-2026:1768989206)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768989206 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...
AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1788769322)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788769322 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...
Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1767098873)
The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767098873 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was...
AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2025:1767098873)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767098873 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...
AlmaLinux 9.2 [TuxCare] Security Update: mariadb / mariadb-backup / mariadb-common / mariadb-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786469793)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786469793 advisory. - In MariaDB server version through 11.8.5, when server audit plugin is enabled with serverauditevents variable configured with...
CentOS Linux 8.4 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1783079573)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783079573 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...
Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789783256)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789783256 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended...
RHEL 8 : rsync (RHSA-2026:74095)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74095 advisory. The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because...
AlmaLinux 9.6 [TuxCare] Security Update: spice-vdagent (ALMALINUX9.6:CLSA-2026:1786552586)
The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786552586 advisory. - A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...
PT-2026-103520
Name of the Vulnerable Software and Affected Versions ZeroClaw versions prior to 0.8.5 Description Software built with the plugins-wasm feature contains a path traversal issue during plugin installation. The system fails to validate the wasm path manifest field, allowing attackers to trick users...
CentOS Linux 7 [TuxCare] Security Update: squashfs-tools (CENTOS7:CLSA-2026:1777544697)
The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777544697 advisory. - squashfsopendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the...
CVE-2026-102089: Improper Limitation of a Pathname to a Restricted Directory
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...
@xhmikosr/decompress: Path traversal via symlink chain
Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...
GHSA-HRH2-VP3X-79XF @xhmikosr/decompress: Path traversal via symlink chain
Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...
NPM: @xhmikosr/decompress: Path traversal via symlink chain
NPM: @xhmikosr/decompress: Path traversal via symlink chain vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...
SUSE CVE-2026-97023
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...
SUSE CVE-2026-97024
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...
GHSA-4P3W-J4W9-5JQW moment vulnerable to Path Traversal via crafted non-string locale name
Impact moment before 2.31.0 is vulnerable to path traversal in moment.locale. When an application passes a non-string, attacker-influenced value to moment.locale, a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. Thi...
