CVE-2026-102089: Improper Limitation of a Pathname to a Restricted Directory

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be leveraged to execute arbitrary code on the...

CVE-2026-102146: External Control of File Name or Path

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files with attacker-controlled content to arbitrary locations accessible to the Email Protection Gateway service account. This exceeds the administrator's intended privileges and could ...

CVE-2026-101295: Improper Limitation of a Pathname to a Restricted Directory

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

Quantum Secret Sharing and Error Correction Vs No-Cloning

Secret sharing is ubiquitous throughout cryptography. All possible access structures are classically feasible, and in the case of threshold access structures, the protocols are even very efficient. However, when moving to the quantum setting, the no-cloning theorem shows that many access structur...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1750783474)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1750783474 advisory. - An issue was discovered in the function gdevprnopenprinterseekable in Artifex Ghostscript through 10.02.0 allows remote attackers ...

AlmaLinux 9.2 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1788433791)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788433791 advisory. - rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete...

TencentOS Server 4: iscsi-initiator-utils (TSSA-2026:1057)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1057 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2025:1740470877)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740470877 advisory. - An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath, the path will be...

Linux Distros Unpatched Vulnerability : CVE-2026-85526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or...

CVE-2026-13224: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request...

CVE-2026-55224: Improper Limitation of a Pathname to a Restricted Directory

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

PT-2026-109726

This update for multipath-tools fixes the following issues: - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in device-mapper-multipath failed wwids management bsc1277210. - SCSI PRIN READ FULL STATUS responses can cause heap buffer overflows...

PT-2026-102969

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results ...

CVE-2026-102843: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/datagaleri.php of the component Endpoint. Performing a manipulation of the argument gbr results i...

PT-2026-103552

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal weakness exists in an optional, non-default administrative feature. This flaw allows an authenticated administrator to move files to unintended...

CVE-2026-103088: Path Traversal: '../filedir'

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-63490 validates template locations as raw percent-encoded strings, whereas the template file is opened through a URL handler that percent-decodes the path. In a...

ALSA-2026:74095 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...

PT-2026-103278

Name of the Vulnerable Software and Affected Versions oc-mirror affected versions not specified Red Hat Assisted Installer for OpenShift Container Platform affected versions not specified OpenShift Container Platform affected versions not specified Description A path traversal and arbitrary file...

Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...

CentOS Linux 8 [TuxCare] Security Update: rsync / rsync-daemon Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1788773469)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1788773469 advisory. - rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filte...