CVE-2026-75593

Prior to BuildKit 0.31.2, a client with control API access can craft an upload request causing files to escape the BuildKit state directory, enabling directory traversal. Fixed in v0.31.2. No exploitation details provided; CVSS 7.2 HIGH (network, low complexity, low privileges required).

GHSA-RR55-JP92-8WP2 claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary claude-faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be...

faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools

Summary faf-mcp MCP tools accept a caller-controlled path argument and resolve it expansion + path.resolve straight into a filesystem read/write without confining it to a trusted project directory. An absolute path or ../ traversal is resolved and used as-is, so the server process can be made to...

EUVD-2026-62571

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-49441 Wazuh : peer-controlled metadata key in process_files_from_worker non-merged branch allows arbitrary file write under WAZUH_PATH on Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

CVE-2026-48024 Wazuh: merged-file header path traversal in cluster sync allows arbitrary file write under WAZUH_PATH in Wazuh manager

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, cluster.unmergeinfo in framework/wazuh/core/cluster/cluster.py constructs paths from peer-controlled mergetype and name values in a merged synchronization archive...

CVE-2026-44829

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives...

CVE-2026-53451 Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

CVE-2026-53451 Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-snapshot leads to remote code execution

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to...

CVE-2026-53451

Ground Station (a browser-based suite for satellite tracking, SDR reception, and telemetry decoding) prior to version 0.4.13 is vulnerable to unauthenticated remote code execution via a path traversal in the save-waterfall-snapshot Socket.IO command. The snapshotName parameter is passed to os.pat...

CVE-2026-47187

Prior to sshfs 3.7.6, the transform_symlink() mitigation returns early at sshfs.c:2181 without handling relative symlink targets, while sshfs_readlink() (sshfs.c:2234–2236) copies server-supplied targets to the kernel. A rogue SFTP server can thus direct local tools (cp, rsync, editors) to read o...

CVE-2026-44829

Gotenberg (a Docker-powered stateless PDF API) versions 8.32.0 and earlier are vulnerable to a path traversal in zip entry names. The root cause is that filepath.Base on Linux does not treat backslashes as path separators, so Windows-style parent directory components (e.g., ..\..\Windows\System32...

EUVD-2026-62421

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile joins the filename to the...

EUVD-2026-62463

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

CVE-2026-76222

GitPython (versions before 3.1.58) fails to sanitize submodule names read from .gitmodules files, enabling path traversal during submodule initialization. An attacker can craft a malicious repository with traversal sequences (e.g., ../) in submodule names, causing GitPython to create attacker-con...

PYSEC-2026-3665 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Summary In Glances 4.5.5 the --disable-config-exec flag was extended GHSA-3vwc-qwhc-3mj7 to stop securepopen from interpreting the shell operators &&, | and in AMP command values taken from the configuration file. The hardening was not applied to the on-alert action command path, which reads its...