PT-2026-99170

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description A path traversal issue exists in the tools.fs.workspaceOnly feature. This occurs because Unicode filename fallback can normalize validated parent directory components, allowing admitted requester...

PT-2026-99146

Name of the Vulnerable Software and Affected Versions Laranode versions prior to 1.2.1 Description Authenticated users can exploit a path traversal flaw to write arbitrary files outside their designated home directory. By providing directory traversal sequences in the path parameter of the 'POST...

PT-2026-99387

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.12 Description An authenticated customer with the export feature enabled can achieve host root and cross-tenant compromise. The issue occurs because the customer data-export DataDump cron fails to validate...

Linux Distros Unpatched Vulnerability : CVE-2026-100689

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27j...

Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal in the txtar handling in sandbox.go, which writes each archive entry with os.WriteFile to a path taken from the entry name with no containment to the intended directory, and to unrestricted environment inheritance in...

Path Traversal

Overview Affected versions of this package are vulnerable to Path Traversal in the txtar handling in sandbox.go, which writes each archive entry with os.WriteFile to a path taken from the entry name with no containment to the intended directory, and to unrestricted environment inheritance in...

[SECURITY] [DLA 4796-1] evolution-data-server security update

Debian LTS Advisory DLA-4796-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 25, 2026 https://wiki.debian.org/LTS Package : evolution-data-server Version : 3.46.4-2+deb12u1 CVE ID : CVE-2026-2604 Debian Bug : 1128332 An issue has been found in...

khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...

GHSA-62MM-XWMV-CRHG khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Summary The /home/filepath:path endpoint in webclient.py serves static files by directly concatenating the user-supplied filepath with the homedirectory constant. There is no path traversal filtering, no path normalization check, and no authentication required. An attacker can use ../ sequences t...

Security Bulletin: Security Vulnerabilities in Third-Party Node.js Packages Used by IBM Rhapsody Systems Engineering

Summary Security vulnerabilities were identified in the product's Node.js dependencies. The issue has been mitigated by removing the vulnerable packages and updating dependencies to secure versions. Vulnerability Details CVEID:CVE-2026-29087 DESCRIPTION: @hono/node-server allows running the Hono...

CVE-2026-100372

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

Security Bulletin: The Analyst Workflow App for IBM QRadar SIEM contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Analyst Workflow App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS takes ...

CVE-2026-100372

ClipBucket v5 versions prior to 5.5.3-#197 are vulnerable to a path traversal vulnerability within the admin template editor. Authenticated users with manage_template_access permissions can exploit the folder parameter by providing directory traversal sequences to move outside the layout director...

CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

EUVD-2026-87315

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

NPM: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools vulnerability discovered by ? in WordPress Npm knowns versions = 0.29.1...

EUVD-2026-72555

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools...

GHSA-9GFJ-28HW-JCHP Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Overview Verified. Multiple Unrestricted Path Traversal vulnerabilities exist in the Knowns MCP docs and memory tools, allowing arbitrary file read, write, and deletion operations outside the project sandbox. The storage layer functions Get, Create, Update, Rename, Delete in both docstore.go and...