PT-2026-102704

Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.4 Description An issue exists where the public removeTmpAttachment action allows the deletion of database rows and files by accepting an integer attachment ID. While the controller verifies a Joomla sessio...

CVE-2026-90915: Improper Limitation of a Pathname to a Restricted Directory

Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...

PT-2026-102802

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

PT-2026-102928

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-12345: Improper Link Resolution Before File Access

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the...

CVE-2026-84422: Improper Neutralization of Special Elements used in an OS Command

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges...

Linux Distros Unpatched Vulnerability : CVE-2026-97023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of...

Linux Distros Unpatched Vulnerability : CVE-2026-47679

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged- in GLPI user can exploit insufficient path validation...

Linux Distros Unpatched Vulnerability : CVE-2026-12345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a...

PT-2026-102691

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Improper validation of the cache group name allows path traversal within the file storage of the caching layer. This flaw enables the arbitrary...

NoMachine Arbitrary File Deletion

NoMachine versions prior to fixed releases 9.4.14 and 8.22.1 contain an external control of file path vulnerability that allows a local low-privileged attacker to delete arbitrary files as root...

CVE-2026-84842: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact system integrity...

CVE-2026-93853: Unverified Ownership

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...

CVE-2026-102362

The mall4j framework, version 4.0 and below , contains a vulnerability where the DELETE /prodComm endpoint in ProdCommController lacks proper authentication controls. This flaw allows unauthenticated attackers to delete arbitrary product reviews by providing a prodCommId parameter without undergo...

CVE-2026-101093 Cotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification. Attackers can craft malicious links or pages that trick authenticated administrators into deleting custom groups and their associate...

Exploit for External Control of File Name or Path in Nomachine

CVE-2026-5053 Abusing a vulnerability on affected installatio...

DEBIAN-CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

UBUNTU-CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...