CVE-2026-10044

Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/filename endpoint on Windows deployments that allows unauthenticated remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal...

PT-2026-35528

If shutil.unpack archive is given a ZIP archive with an absolute Windows path containing a drive C:... then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability...