SUSE SLED15: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (SUSE-SU-2026:4406-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4406-1 advisory. - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

PT-2026-111189

Affected files dulwich/index.py Methods: validate path element ntfs, tree to fs path dulwich/porcelain/ init .py Method: checked worktree path Description / Summary A High-severity Path Traversal vulnerability exists in Dulwich's checkout logic when running on Windows. The functions responsible f...

PT-2026-104135

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0 Description Improper certificate validation occurs in the PkixNameConstraintValidator specifically within the ExtractHostFromURL function. This issue allows a name-constrained subordinate CA, or an entity...

PT-2026-104123

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0 Description Improper certificate validation occurs in the PkixNameConstraintValidator function. An attacker controlling a name-constrained intermediate CA can cause certificates to be accepted during PKIX...

PT-2026-104330

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.4 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. An attacker who can influence this M...

PT-2026-104228

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.0 through 6.63.x Description A path traversal issue exists in the theme translation file loading process. This allows authenticated administrators to read JSON files located outside the active theme directory by manipulatin...

CVE-2026-51906

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-51907

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

EUVD-2026-91700

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

EUVD-2026-91701

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...

PT-2026-104366

Name of the Vulnerable Software and Affected Versions TaskingAI version 0.3.0 Description In the DALL-E 3 image generation tool, the save url image function contains a path traversal flaw. This allows attackers to write downloaded images to arbitrary locations on the server filesystem by...

PT-2026-104357

Name of the Vulnerable Software and Affected Versions uv versions 0.12.7 through 0.12.17 Description On Windows, the wheel extraction process can be manipulated by a malicious wheel to write files outside the intended installation prefix. This allows for the placement of an executable file into a...

PT-2026-104367

In TaskingAI v0.3.0 in the QR Code Generator plugin save base64 image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project id parameter...

PT-2026-104392

Name of the Vulnerable Software and Affected Versions image-downloader version 4.3.0 Description A path traversal issue exists where an attacker who can control the download URL can cause the downloaded response data to be written outside the configured destination directory. Path traversal is a...

CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-51907

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

PT-2026-104422

Name of the Vulnerable Software and Affected Versions Angular SSR versions 17 through 18 Angular SSR versions prior to 20.3.36 Angular SSR versions prior to 21.2.23 Angular SSR versions prior to 22.1.7 Description An issue exists in the retrieveSSGPage logic within @angular/ssr/node and...

PT-2026-104460

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 2.3.13 Description Authenticated panel users with backup download or delete permissions can read or delete arbitrary files. This occurs in the BackupController when a base64-encoded backslash-separated traversal...

PT-2026-104448

Dell Container Storage Modules, versions prior to 1.18.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...