Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...

PT-2026-91208

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. CoreUpgradeController and BackupService e.g. BackupService::deleteBackup concatenate the user-supplied backup file/filename value directly onto the backup directory path without...

PT-2026-91199

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

PT-2026-91292

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repo url as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions includin...

PT-2026-91266

The CVE Program recognizes that this CVE Record provides vulnerability information that a Supplier CNA believes is very important to consumers. The CVE Program has flagged this CVE Record as it assigns a single CVE ID to a collection of individual vulnerabilities which does not align with CVE's...

PT-2026-91401

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...

PT-2026-91072

Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be viewed and/or altered by an attacker who can access the product via FTP...

CVE-2023-40772

CVE-2023-40772 is a directory traversal vulnerability in DataEase versions prior to 1.18.10 , located in the StaticResourceController.java component. A remote attacker with low privileges can craft a request to this controller to read sensitive information, resulting in a low confidentiality impa...

CVE-2023-40772

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

PT-2026-91052

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

CVE-2023-45858

CVE-2023-45858 is a directory traversal vulnerability in Paessler PRTG versions prior to 23.4.88.1429 , allowing an unauthenticated, remote attacker to read local files. The CVSS v3.1 score is 8.6 (HIGH) with a changed scope and high confidentiality impact , while integrity and availability are u...

PT-2026-91441

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the confluence upload attachment and confluence upload attachments tools pass a client-controlled file path through src/mcp atlassian/confluence/attachments.py upload attachment, and...

Amazon Linux 2023 : composer (ALAS2023-2026-2152)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2152 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the...

CVE-2023-40772

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

PT-2026-91687

A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to modify protected system files...

PT-2026-91758

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

PT-2026-91742

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

RHEL 9 : acl (RHSA-2026:67144)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67144 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

Linux Distros Unpatched Vulnerability : CVE-2026-82035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output...

PT-2026-91423

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path traversal vulnerability...