PT-2026-105109

kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...

CVE-2025-41753: Improper Limitation of a Pathname to a Restricted Directory

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...

PT-2026-104054

Name of the Vulnerable Software and Affected Versions Office-PowerPoint-MCP-Server versions prior to 2.0.8 Description A path traversal issue allows callers to read and write files outside the intended working directory by using absolute paths or ../ sequences. An attacker can use prompt injectio...

PT-2026-103662

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schema name resul...

CVE-2025-71427: Improper Limitation of a Pathname to a Restricted Directory

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...

AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2025:1739822224)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739822224 advisory. - A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1788520884)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1788520884 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

AlmaLinux 9.2 [TuxCare] Security Update: autocorr-af / autocorr-bg / autocorr-ca / autocorr-cs / autocorr-da / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1746190792)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746190792 advisory. - Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run...

Rocky Linux 9 [CIQ] Security Update: python3.11 / python3.11-debug / python3.11-debuginfo / etc (crlsa-2024_4077)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20244077 advisory. python: Path traversal on tempfile.TemporaryDirectory CVE-2023-6597 Tenable has extracted the preceding description block directly from the CIQ security advisory...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (crlsa-2025_2600)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20252600 advisory. rsync: Path traversal vulnerability in rsync CVE-2024-12087 rsync: --safe-links option bypass leads to path traversal CVE-2024-12088 rsync: Race Condition ...

Rocky Linux 10.1 [CIQ] Security Update: tar / tar-debuginfo / tar-debugsource (crlsa-2026_0002)

The Rocky Linux 10.1 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260002 advisory. tar: Tar path traversal CVE-2025-45582 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Nessus has not...

Rocky Linux 8 [CIQ] Security Update: python3-babel (crlsa-2021_4201)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20214201 advisory. python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code CVE-2021-20095, CVE-2021-42771 Tenable has extracted...

Rocky Linux 9 [CIQ] Security Update: mariadb / mariadb-backup / mariadb-backup-debuginfo / etc (crlsa-2026_0137)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260137 advisory. mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation CVE-2025-13699 Tenable has extracted the preceding descripti...

Rocky Linux 10.2 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_21757)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202621757 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion on...

Check Point Gaia Operating System (sk1000171)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk1000171 advisory. - A path traversal and arbitrary file upload vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server,...

AlmaLinux 9.6 [TuxCare] Security Update: ldns / ldns-devel / ldns-doc / ldns-utils / perl-ldns / etc (ALMALINUX9.6:CLSA-2026:1784215324)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784215324 advisory. - NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as stub resolver over UDP, lacks matching the query...

AlmaLinux 9.6 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1768821437)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768821437 advisory. - Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rul...

Rocky Linux 9 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_21755)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202621755 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion on host...

Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228506 advisory. netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data CVE-2021-37136 netty-codec: SnappyFrameDecoder doesn't restrict chu...

Linux Distros Unpatched Vulnerability : CVE-2026-102875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives...