CentOS Linux 6 [TuxCare] Security Update: tomcat6 / tomcat6-admin-webapps / tomcat6-docs-webapp / etc (CENTOS6:CLSA-2025:1755513827)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2025:1755513827 advisory. - Path Equivalence: 'file.Name' Internal Dot leading to Remote Code Execution and/or Information disclosure and/or malicious content added to...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: openssh (UTSA-2026-126160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126160 advisory. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when sftp server:/path . is used with an attacker-controlled server. Tenable...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1788769322)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788769322 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1788953354)

The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1788953354 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root...

CentOS Linux 8.4 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1783079573)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783079573 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gkeyfilegetlocalestringlist function in the gkeyfile.c file when...

PT-2026-103123

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726: Improper Certificate Validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

PT-2026-103552

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal weakness exists in an optional, non-default administrative feature. This flaw allows an authenticated administrator to move files to unintended...

CVE-2026-51570: Improper Limitation of a Pathname to a Restricted Directory

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in inserttextfile...

CVE-2026-102089: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1788773469)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1788773469 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filte...

CVE-2026-10739: Relative Path Traversal

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788433791)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788433791 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1789786148)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789786148 advisory. - rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local...

Rocky Linux 9.6 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / osbuild-composer-tests / etc (ALMALINUX9.6:CLSA-2026:1790266264)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790266264 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1776847322)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1776847322 advisory. - libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate...

CVE-2026-51570

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in inserttextfile...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (CENTOS-STREAM8:CLSA-2026:1769092364)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1769092364 advisory. - 1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target...

CentOS Linux 7 [TuxCare] Security Update: curl / libcurl / libcurl-devel Multiple Vulnerabilities (CENTOS7:CLSA-2023:1697816385)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2023:1697816385 advisory. - libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1789783256)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789783256 advisory. - rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended...