PT-2026-97728

Name of the Vulnerable Software and Affected Versions eesy ID2WP – Publish InDesign HTML5 versions prior to 1.0.4 Description The plugin is subject to Path Traversal, a condition where an attacker can access files and directories that are stored outside the web root folder. Unauthenticated...

PT-2026-98259

Name of the Vulnerable Software and Affected Versions ruoyi-vue-pro versions prior to 2026.09 Description A path traversal issue exists in the File Upload component. This occurs within the getOriginalFilename function located in the...

OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure

Publicly exposed large language model LLM infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and...

PT-2026-98237

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...

CVE-2026-96884: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-90959: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

PT-2026-97849

Name of the Vulnerable Software and Affected Versions pulpcore affected versions not specified Description A path traversal issue exists in the content upload API via the file url parameter. The system employs a validation check that rejects URLs starting with 'file://', but because Python's URL...

PT-2026-98206

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.3 Description A path traversal issue exists that can be triggered remotely. The flaw is located within the get file content, save file content, move files, and start streaming functions of the page.htm...

PT-2026-98278

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The HTTP server in the firmware contains a path traversal flaw. This allows an attacker connected to the device WiFi network to send a specially crafted request to access files on the...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

Security update for ant (important)

openSUSE security update: security update for ant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21891-1 Rating: important References: bsc1188469 bsc1246873 bsc1280015 Cross-References: CVE-2021-36374 CVE-2025-7962 CVE-2026-78254 CVSS scores:...

SUSE CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-96678

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678 weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal

A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument...

CVE-2026-96678

A path traversal vulnerability exists in the Avatar Upload component of weiqingwen spring-boot-forum (affected up to commit 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f). The flaw is located in the validate function within the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java, where ma...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the "lng" and "ns" query parameters in the "/locales/resource.json" endpoint. This allows the attacker to read sensitive ".json" files from the pod filesystem, includi...

CVE-2026-75887 Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-75887

A path traversal vulnerability exists in the OpenShift console within the i18n locale handler . An unauthenticated attacker can manipulate the lng and ns query parameters in the /locales/resource.json endpoint to read sensitive *.json files from the pod filesystem, such as configuration files and...