CVE-2026-51880

deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...

CVE-2026-51875

In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...

CVE-2026-51884

The /knowledgebase/uploadtempdocs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...

CVE-2026-51874

In Devika v1.0, the Patcher Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace...

CVE-2026-51883: Improper Limitation of a Pathname to a Restricted Directory

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

PT-2026-103942

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A path equivalence issue exists in the mod userdir module when configured with an absolute non-wildcard UserDir directive. This flaw involves the use of the /./ single dot directory...

PT-2026-103911

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description A Zip Slip path traversal issue exists during the migration ZIP import process. Authenticated administrators can write arbitrary files outside the intended extraction directo...

PT-2026-103921

The revoked-key error path builds a human-readable failure reason using sprintf into a heap buffer. The allocated buffer is too small for the final formatted message. When sprintf writes the full message, it can write past the end of the heap allocation...

PT-2026-103873

Name of the Vulnerable Software and Affected Versions Sharp and Toshiba Tec rebranded multifunction printers affected versions not specified Description An unauthenticated local file inclusion issue exists, allowing remote attackers to read arbitrary files. By manipulating the path parameter in t...

CVE-2026-55393: Improper Limitation of a Pathname to a Restricted Directory

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal...

PT-2026-105583

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

AlmaLinux 9.2 [TuxCare] Security Update: cpio (ALMALINUX9.2:CLSA-2026:1786620962)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786620962 advisory. - Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches which had caused a...

Rocky Linux 9 [CIQ] Security Update: python3-setuptools / python3-setuptools-wheel (crlsa-2025_10407)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510407 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 8 [CIQ] Security Update: Judy / Judy-debuginfo / Judy-debugsource / galera / etc (crlsa-2026_0233)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20260233 advisory. mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation CVE-2025-13699 Tenable has extracted the preceding descripti...

RockyLinux 8 : rsync (RLSA-2026:74095)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:74095 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: Arbitrary file deletion via malicious file...

Rocky Linux 9 [CIQ] Security Update: python3.14-pip / python3.14-pip-wheel (crlsa-2026_36315)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636315 advisory. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-8643 Tenable has extracted the precedi...

Rocky Linux 10.2 [CIQ] Security Update: libipa_hbac / libipa_hbac-debuginfo / libsss_autofs / etc Multiple Vulnerabilities (crlsa-2026_41937)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202641937 advisory. sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation CVE-2026-14474 sssd: sssd:...

Rocky Linux 10.2 [CIQ] Security Update: tar / tar-debuginfo / tar-debugsource Multiple Vulnerabilities (crlsa-2026_61586)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661586 advisory. tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path esca...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2025_14900)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202514900 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8194...