CVE-2026-87723: Untrusted Search Path

In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the securit...

PT-2026-99896

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...

PT-2026-99960

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.72 FreePBX versions prior to 17.0.7 Description A flaw in the backup Module allows authenticated attackers with sufficient permissions or write access to backup files to execute arbitrary code on the server. The...

CVE-2026-101067: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile of the file files.js of the component save-uploaded-file Endpoint. Such manipulation of the argument filePath/fileName leads to path traversal. The attack may be launched...

GitPython Path Traversal Privilege Escalation

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to improper external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

CVE-2026-101082: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argument FullFileName/FileName causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public an...

CVE-2026-87799: Improper Link Resolution Before File Access

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client that can create instances or custom storage volumes in a project, or a malicious migration source server, to write...

CVE-2026-101070: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...

CVE-2026-101068: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote...

PT-2026-99877

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal issue exists in the Export Handler component within the exportModelSql function of the packages/api/src/controllers/databaseConnections.js file. A remote attacker can manipulate the...

PT-2026-99861

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal issue exists in the Archive Link Creation component. A remote attacker can manipulate the linkedFolder argument within the createLink function located in the...

PT-2026-99870

Name of the Vulnerable Software and Affected Versions dbgate versions 6.x through 6.8.1 dbgate versions 7.0.x through 7.0.2 dbgate versions 7.1.x through 7.1.8 dbgate versions 7.2.x through 7.2.5 dbgate versions 7.3.x through 7.3.1 Description A path traversal issue exists in the save-uploaded-fi...

PT-2026-102394

Name of the Vulnerable Software and Affected Versions Dozzle versions prior to 11.1.2 Description Insufficient sanitization of container display names occurs when building ZIP archive entry names in the log download endpoint. Attackers with the ability to label containers can employ path traversa...

WS-2026-0084

OpenBao before 2.6.3 / 2.7.0-beta evaluated ACL policies against the raw request path, while several backends policies, cert, userpass and kubernetes auth roles, PKI, workflows resolve names canonically, for example case-insensitively or with whitespace and path segments normalized. A token...

PT-2026-99839

Name of the Vulnerable Software and Affected Versions FLB-Music FLB-Music-Player versions 1.1.8 through 1.2.1 Description A path traversal issue exists in the path.join function within the /src/main/core/createParsedTrack.ts file. This flaw allows a local attacker to manipulate file paths to acce...

CVE-2026-101036: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The exploit has been disclosed to the public...

PT-2026-99764

Name of the Vulnerable Software and Affected Versions Google fuse-archive versions prior to 1.24 Description An attacker can hijack the execution pathway by prepending a directory to the PATH environment variable or by writing a malicious binary to a writable directory that appears in the PATH...

PT-2026-102330

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description A path traversal issue exists in the way the software handles the export/bin directory during app deployment. This allows a malicious application to trigger the deletion of arbitrary files...

PT-2026-99889

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.0.2 through 4.0.13 Canonical LXD versions 5.0.0 through 5.0.9 Canonical LXD versions 5.21.0 through 5.21.7 Canonical LXD versions 6.0.0 through 6.9.x Description A path traversal issue exists in the btrfs storage drive...

CVE-2026-85185: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...