PT-2026-71633

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the --temp-dir or --link-dest options, whi...

PT-2026-71546

Subscriber Arbitrary File Download in AI Hub = 1.3.10 versions...

PT-2026-71638

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink race condition exists in the --remove-source-files feature. This occurs when an attacker with symlink creation access atomically substitutes a symlink for a source file between the completion...

SUSE SLED15 / SLES15 Security Update : python3-pip (SUSE-SU-2026:3588-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3588-1 advisory. This update for python3-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package...

PT-2026-71904

Name of the Vulnerable Software and Affected Versions luci-app-openvpn affected versions not specified Description Authenticated users can perform path traversal and write arbitrary files outside the intended directory because the software fails to properly validate the instance name2 parameter...

CVE-2026-53795

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside t...

PT-2026-71640

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description An arbitrary file read issue exists due to improper symlink following during the handling of input configuration files. Attackers can read files accessible to the rsync daemon process by placing a...

PT-2026-71543

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

PT-2026-71737

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...

SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:3589-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3589-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package UR...

PT-2026-76572

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.1.0 Description Files src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts generate temporary filenames using Math.random, which is not cryptographically secure and predictable across calls withi...

PT-2026-71660

Name of the Vulnerable Software and Affected Versions rsync versions 2.3.3 through 3.4.x Description A path traversal issue exists where a malicious sender can escape the module root by exploiting symlinks within the module file tree. This occurs when using the --partial-dir or --backup-dir...

PT-2026-71627

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description Improper path handling allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree. By sending a crafted file list, an attacker can cause the receiver t...

CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

PT-2026-71827

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

Linux Distros Unpatched Vulnerability : CVE-2026-63293

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an...

PT-2026-71641

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A symlink following issue exists where local attackers can overwrite arbitrary files by placing a symbolic link at a predictable output path. This occurs because the software fails to reject symlinks...

CVE-2026-73498

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

CVE-2026-64826

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying unsanitized directory traversal sequences in the filename GET parameter of the downloadexport method. Attackers can craft requests with ../ sequences to escape th...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...