CVE-2024-58387: Improper Limitation of a Pathname to a Restricted Directory

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

CVE-2026-102095: Server-Side Request Forgery (SSRF)

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery. Kiteworks Email Protection Gateway performed server-side fetches of URLs contained in the message content it processed, without adequately restricting the fetch destination. A remote,...

PT-2026-103533

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description An issue exists where the system performs server-side fetches of URLs found within processed message content without sufficient destination restrictions. This allows a...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760018787)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018787 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666...

CVE-2026-55177: Server-Side Request Forgery (SSRF)

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

PT-2026-103594

Name of the Vulnerable Software and Affected Versions Inspur Haiyue HCM Cloud affected versions not specified Description An arbitrary file read issue exists in the '/api/model report/file/download' endpoint. Unauthenticated remote attackers can read arbitrary files by providing unvalidated path...

Linux Distros Unpatched Vulnerability : CVE-2026-93853

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots...

VulnCheck KEV: CVE-2024-58387

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

DEBIAN-CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-94204

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-96587

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

UBUNTU-CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-93853

The Barman backup tool is vulnerable to unverified ownership during snapshot backup deletion, affecting versions up to and including 3.20.0 (specifically versions from 3.4.0 for Google Cloud, 3.6.0 for Azure, and 3.7.0 for AWS). The root cause is that Barman reads snapshot identifiers from the ba...

CVE-2026-93853 Barman snapshot backup deletion trusts unverified backup catalog metadata

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

EUVD-2026-89463

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-93853 Barman snapshot backup deletion trusts unverified backup catalog metadata

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-93853

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...