CVE-2026-78214: Incorrect Authorization

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

PT-2026-108436

Security vulnerability affects the apache-hive package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...

CVE-2026-8066: Relative Path Traversal

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...

PT-2026-102634

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.9 Description The safe join function used by send from directory fails to remove empty NTFS Alternate Data Stream ADS markers before checking Windows device names. On Windows systems using NTFS, if an application...

PT-2026-109115

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe join function used by send from directory can allow a NUL: special-device path because safe join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application ru...

PT-2026-108417

Security vulnerability affects the sonarqube package. Path-traversal vulnerability in QOS...

PT-2026-108386

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

PT-2026-102446

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.18.4 Description A path traversal issue exists in the way Flatpak handles the files/etc directory during app deployment. This allows a malicious application to empty or replace critical host system files, such as...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-102875: Improper Limitation of a Pathname to a Restricted Directory

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

PT-2026-102779

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handle request function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...

Important: composer

Issue Overview: Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a...

PT-2026-102891

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-84421: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

CVE-2026-102831: Improper Neutralization of Input During Web Page Generation

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5.11 and 4.6.4, from Notebook 7.5.0 until 7.6.3, and from JupyterLite Core 0.7.0 until 0.8.4, the system clipboard cell-paste path accepts...

CVE-2026-102722: Server-Side Request Forgery (SSRF)

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...

Linux Distros Unpatched Vulnerability : CVE-2024-58386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The...

Amazon Linux 2023 : rclone (ALAS2023-2026-3129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Linux Distros Unpatched Vulnerability : CVE-2026-85185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...