Linux Distros Unpatched Vulnerability : CVE-2026-118485

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename...

CVE-2026-56446

MISP allowed a site administrator to configure an arbitrary filesystem path for the NDJSON error log used by JsonLogTool. Because log entries can include attacker-controlled content, an authenticated attacker with site administrator privileges could direct log output to a PHP file in a...

CVE-2026-49340

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, a logic error in "ServeCreateOrUpdatePlaylist" allows any authenticated Subsonic user including non-admin to write playlist M3U content to an attacker-controlled absolute filesystem path...

PT-2025-52500

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0 Description Langflow is a tool for building and deploying AI-powered agents and workflows. Before version 1.7.0, specifying an arbitrary path in the request body's fs path allows server-side file creation or...

libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning

It was found that libreoffice was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system...