CVE-2026-65829: Improper Limitation of a Pathname to a Restricted Directory

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in...

PT-2026-97037

Name of the Vulnerable Software and Affected Versions MPXJ versions 7.3.0 through 16.4.0 Description Reading a specially crafted Primavera P3 PRX or SureTrak STX file can allow the library to write files to arbitrary locations within the filesystem. Recommendations Update to version 16.5.0. Avoid...

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

CVE-2026-61647 @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...

CVE-2026-61647 @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-62369 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destinatio...

CVE-2026-62369 KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destinatio...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

EUVD-2026-83974

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-53940 Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-53940

Conda versions prior to 26.5.2 are vulnerable to a path traversal during noarch:python package installation. The function parse_entry_point_def in conda/common/path/python.py accepted an unvalidated entry-point command from a package's info/link.json metadata, which was then interpolated into the...

PT-2026-96249

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.6.15 Joplin versions prior to 3.7.2 Description Joplin accepts synchronized resource metadata where the id or file extension contains path-separator or parent-directory characters. The BaseItem.unserialize function...

CVE-2026-61647: Improper Limitation of a Pathname to a Restricted Directory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...

PT-2026-96140

Name of the Vulnerable Software and Affected Versions Conda versions prior to 26.5.2 Description The parse entry point def function in conda/common/path/python.py accepts unvalidated entry-point commands from the info/link.json metadata of noarch:python packages. The CreatePythonEntryPointAction ...

CVE-2026-92253

WatchDog Anti-Virus 1.8.640 on Windows is affected by an improper link resolution vulnerability in its quarantine restoration process . A local, low-privileged attacker can create a directory junction at the original path of a quarantined file and, by persuading an administrator to restore that f...