CVE-2026-95698: Improper Limitation of a Pathname to a Restricted Directory

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

PT-2026-97033

Name of the Vulnerable Software and Affected Versions WuzhiCMS version 5.0.0 Description An unrestricted file upload issue exists in the thumbnail-upload endpoint '/index.php?m=member&f=article&v=thumbUpload'. An authenticated low-privileged member can upload a crafted .php file to execute...

PT-2026-96769

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls file exists on the resulting path. The organization name field is attacker-controllable through event...

CVE-2025-1280: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

PT-2026-97034

Name of the Vulnerable Software and Affected Versions openCode version 1.18.26 Description Missing path validation in the Worktree.remove component allows attackers to perform arbitrary recursive directory deletion using a crafted payload. This issue is a path traversal flaw, which occurs when an...

EUVD-2026-84856

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

PT-2026-97015

Name of the Vulnerable Software and Affected Versions Apache Lounge Windows distribution of Apache HTTP Server affected versions not specified Description This issue involves insecure installation directory permissions within the default install directory on C:. The directory inherits write acces...

CVE-2026-77260: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Confluence and Jira uploadattachment implementations accept an unconstrained filepath and open the referenced server-local file. A permitted MCP caller can upload sensitive host...

CVE-2026-77270: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled filepath values as trusted server-local paths. The server opens the selected file and uploads it to an Atlassia...

CVE-2026-77248: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while uploadattachment accepts an unrestricted filepath. An...

CVE-2026-77253: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

CVE-2026-77257: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided filepath to local file operations without restricting it to the workspace. A remote MCP caller with tool access ca...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-090031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090031 advisory. Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2026-054036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054036 advisory. Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege...

CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

UBUNTU-CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

CVE-2026-79318

web2py 3.2.2-stable commit a7330a2bf21219fa77860b6665de927dd4f98e6d is vulnerable to Directory Traversal in readfile/writefile applications/admin/controllers/webservices.py...

CVE-2026-94383 MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitization applied was basename to strip path components and a check for empty or dot values. A site administrator could specify a filename with an arbitrary...