CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

CVE-2026-72910

CVE-2026-72910 affects ERPNext prior to versions 15.112.0 and 16.22.0. The issue arises because the functions merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center (across ERPNext code paths: erpnext/accounts/doctype/account/account.py, erpnext/account...

GHSA-CF44-9PGV-M4XC vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-59733 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030 unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72880

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72880 Dokploy: Arbitrary File Write + Remote OS Command Injection via `certificatePath`

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and packages/server/src/services/certificate.ts joins that value to the certificate root withou...

CVE-2026-72880

Dokploy is affected by CVE-2026-72880. Before version 0.29.13, the apiCreateCertificate schema in packages/server/src/db/schema/certificate.ts accepts a client-supplied certificatePath, and certificate.ts joins that value to the certificate root without confinement. An authenticated user with cer...

CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339 Authenticated Arbitrary File Write Vulnerability in multiple devices

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

EUVD-2026-55700

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on t...

CVE-2026-12339

Technical details are not publicly available in the provided documents for CVE-2026-12339. No vendor-confirmed impact, affected products, or remediation are specified here. Monitor for updates and refer to the CVE entry for official details.

SUSE-SU-2026:3562-1 Security update for freerdp

This update for freerdp fixes the following issues: - CVE-2026-27951: 32-bit system denial of service via endless blocking loop in StreamEnsureCapacity bsc1258939. - CVE-2026-33952: client denial of service via unvalidated authentication length field bsc1261196. - CVE-2026-33977: client denial of...

CVE-2026-49007

creationtimestamp| type| source ---|---|--- 2026-08-10 17:59:21+00:00| seen| https://gist.github.com/digitalgangst4r/e56a1a1494c1ac4d81a87fddc57a712a...

CVE-2026-18412

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...