Linux Distros Unpatched Vulnerability : CVE-2024-58386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The...

Amazon Linux 2023 : rclone (ALAS2023-2026-3129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : composer (ALAS2023-2026-3136)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3136 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

Linux Distros Unpatched Vulnerability : CVE-2026-97023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of...

PT-2026-102446

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.4 Description A path traversal issue exists in the way Flatpak handles the files/etc directory during app deployment. This allows a malicious application to empty or replace critical host system files, such as...

Linux Distros Unpatched Vulnerability : CVE-2026-97024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syste...

CVE-2026-97024: UNIX Symbolic Link (Symlink) Following

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

Linux Distros Unpatched Vulnerability : CVE-2026-47679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged- in GLPI user can exploit insufficient path validation...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

SUSE CVE-2026-44948

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...

SUSE CVE-2026-100419

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious repository trees...

SUSE CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-102332

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102332

Dozzle versions prior to 11.1.2 are vulnerable to a path traversal flaw in the log download endpoint. The issue occurs because the software fails to sanitize container display names when constructing ZIP archive entry names. An attacker capable of labeling containers can inject path traversal seq...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2026-102332 Dozzle before 11.1.2 Path Traversal via Log ZIP Download

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...

CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...

DEBIAN-CVE-2024-58386

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...