CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

CVE-2026-54083

Wazuh is an open-source security platform (XDR/SIEM). The ip-customblock active response script contains a path traversal vulnerability: it concatenates the srcip field from alert JSON directly onto the /ipblock/ base directory without validating that the value is a well-formed IP address. Unlike...

CVE-2026-54083 Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script...

GO-2026-6296 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno

Kyverno's NamespacedGeneratingPolicy generator.apply namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system in github.com/kyverno/kyverno...

CVE-2026-59311

Spring Integration is vulnerable to a symlink pre-creation attack on its predictable /tmp/ziptransformer work directory. A local unprivileged user on the same host can pre-create that path as a symlink before the application starts, redirecting all Zip/Unzip transformer output into a directory of...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-65931 LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-65931 LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint

LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuentries/sa/create and create new survey...

CVE-2026-76222

A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal sequences. When GitPython processes these malicious submodule...

CVE-2021-1480

creationtimestamp| type| source ---|---|--- 2026-08-27 12:00:10+00:00| seen| Telegram/3xgIFenv1edoPacx2wzYue6QEd1BAY1Qzt7qv1fx21mAco 2026-08-28 00:00:53+00:00| seen| Telegram/3xgIFenv1edoPacx2wzYue6QEd1BAY1Qzt7qv1fx21mAco 2026-08-29 00:00:16+00:00| published-proof-of-concept|...

WordPress User Registration & Membership plugin < 5.2.6 - Unauthenticated Account Creation While Registration Disabled vulnerability

Unauthenticated Account Creation While Registration Disabled vulnerability discovered by Nguyễn Đức Hòa in WordPress Plugin User Registration versions 5.2.6...

EUVD-2026-66446

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to delegated administrators being able to retrieve invitation registration links for non-existent email addresses, allowing them to create unauthorized user accounts and add them to an organization without the required use...

EUVD-2026-66771

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...

SUSE CVE-2026-80531

In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc-tempip in xreptempfilecreate LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc-tempip. Fix that...

open-iscsi: open-iscsi: Privilege Escalation via Path Traversal

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...

PT-2026-82559

APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the...